# PhishDestroy domain threat record: amisto-connect.cc

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/amisto-connect.cc/
Machine-readable companion: https://phishdestroy.io/domain/amisto-connect.cc/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-21 02:17:12 UTC
- Last availability or vendor check: 2026-10-21 10:41:27 UTC
- Stored record updated: 2026-10-21 18:20:33 UTC
- VirusTotal detections in the stored snapshot: 14/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 103.224.212.142
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2025-10-17 09:05:18 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a15c47-9701-71fb-9812-406038009dea/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/amisto-connect.cc
- Certificate Transparency search: https://crt.sh/?q=%25.amisto-connect.cc
- Web Archive lookup: https://web.archive.org/web/*/https://amisto-connect.cc/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed amisto-connect.cc as a suspicious domain because VirusTotal returned twelve malicious vendor detections. The recorded page title is simply "amisto-connect.cc/" with no additional content. The domain was first seen by PhishDestroy on 2026-10-21 and returned an HTTP 200 response at that time.

How the scam works
The available detections indicate the site is associated with malicious activity, but no specific phishing, malware, or fraud mechanism has been observed on the page itself. Consequently, the listing reflects a general risk that the domain could be used for credential harvesting, malware delivery, or other fraudulent purposes without confirming any particular method.

Evidence
VirusTotal scanned the domain on 2026-10-18 (retrieved 2026-10-21) and reported 12 malicious and 2 suspicious detections out of 92 engines, for a total of 14 detections. urlscan captured the site on 2026-08-08 and labeled it malicious, while a later capture on 2026-10-21 showed engine‑based malicious flags but an overall non‑malicious verdict. Cloudflare Radar recorded a malicious verdict on 2026-10-21, categorising the domain as malware. Google Safe Browsing checked the site on 2026-10-21 and did not flag it, and OTX listed four pulses referencing the domain as of the same date. No external blocklists reported the domain, while PhishDestroy’s internal list includes it.

Infrastructure
The domain was registered on 2025-10-17 through Dynadot Inc. Hosting records show the site resolved to IP 103.224.212.142, belonging to Trellian Pty. Limited in Australia. No further infrastructure details are provided.

What to do
Avoid entering any credentials, downloading files, or clicking links on this domain. Organizations should block the domain at the network perimeter and review logs for any connections to the recorded IP address. Users who may have interacted with the site should monitor accounts for suspicious activity and change passwords if credentials were submitted.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a15c47-9701-71fb-9812-406038009dea/
VirusTotal report: https://www.virustotal.com/gui/domain/amisto-connect.cc
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=amisto-connect.cc
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-21 02:57:35 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/4g4J6mv1/84a80b1e1904.png
  Captured: 2026-10-21 02:27:42 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a15c47-9701-71fb-9812-406038009dea.png
  Captured: 2026-10-21 02:27:42 UTC
  Source report: https://urlscan.io/result/01a15c47-9701-71fb-9812-406038009dea/
- URLScan capture 2: https://urlscan.io/screenshots/019fe211-4e97-760f-b5f3-31b0832ea1be.png
  Captured: 2026-10-21 02:17:12 UTC
  Source report: https://urlscan.io/result/01a15c47-9701-71fb-9812-406038009dea/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/fa022802-0c39-4e91-86c5-37b43d38c233.png
  Captured: 2026-10-21 02:24:32 UTC
  Source report: https://radar.cloudflare.com/scan/fa022802-0c39-4e91-86c5-37b43d38c233
  SHA-256: 821ed7bd66c66ba214c70e1b20dab743e60106decdc9b645c53b0490ef8a7fcd
- URLQuery: https://screenshots.phishdestroy.io/uq/0ffae144-062e-479c-84e9-110c688fd90b.png
  Source report: https://urlquery.net/report/0ffae144-062e-479c-84e9-110c688fd90b
  SHA-256: 067ce99ea6cf468bb9d701404904441225d82f0458a1d73a0c714eff9a86930d
- URLScan · 2026-08-08: https://screenshots.phishdestroy.io/us/019fe211-4e97-760f-b5f3-31b0832ea1be.png
  Captured: 2026-08-08 15:50:46 UTC
  Source report: https://urlscan.io/result/019fe211-4e97-760f-b5f3-31b0832ea1be/
  SHA-256: 6cfd197b0abbcccc9fa45deb6556fb9768e97a0eedfe804aa2feed3b92ff4531
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15c4b-cf95-77cf-b912-a904c7e27e7d.png
  Captured: 2026-10-21 02:31:33 UTC
  Source report: https://urlscan.io/result/01a15c4b-cf95-77cf-b912-a904c7e27e7d/
  SHA-256: 7b24619492c26054bfb7a5f2a0f17c4d613389f6e2a353bccb684225a42a32a0

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T02:30:14Z",
        "uuid": "01a15c47-9701-71fb-9812-406038009dea",
        "scanned_at": "2026-10-21T02:26:04Z",
        "final_url": "https://amisto-connect.cc/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://amisto-connect.cc/",
                "from": "http://amisto-connect.cc/",
                "status": 307
            }
        ],
        "ip": "103.224.212.142",
        "ptr": "lb-212-142.above.com",
        "domains": [
            "assets.abovedomains.com"
        ],
        "ips": [
            "185.111.111.154",
            "103.224.212.142"
        ],
        "asns": [
            "212238",
            "133618"
        ],
        "countries": [
            "DE",
            "AU"
        ],
        "link_domains": [
            "www.dynadot.com"
        ],
        "doc_hash": "bb467e24c84212eff7b2c638197b2b26bffaa0bacf0dac3f3f40aa12ec9455ea",
        "tls": {
            "san": [
                "*.18962.net",
                "*.22710.vip",
                "*.25103.vip",
                "*.307-215.top",
                "*.80548.my",
                "*.aitv.now",
                "*.alimenttrust.live",
                "*.amisto-connect.cc",
                "*.balenciagasneaker.us",
                "*.berryvanilla.com"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YE1",
            "subject": "orlandousedautoparts.shop",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-15T18:32:21Z",
            "valid_from": "2026-10-17T18:32:22Z"
        },
        "domain_age_days": 368,
        "apex_age_days": 368,
        "tls_age_days": 3,
        "tls_valid_days": 89,
        "requests": 3,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 16,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:30:13Z",
        "uuid": "fa022802-0c39-4e91-86c5-37b43d38c233",
        "scanned_at": "2026-10-21T02:24:32Z",
        "final_url": "https://amisto-connect.cc/",
        "status": 200,
        "history": [
            {
                "url": "https://amisto-connect.cc/",
                "status": 200
            }
        ],
        "dom_hash": "f737d713dbf8c2aa26cc80eb4c4bbd657f709164e12199b75b72a4d0c4d8e763",
        "doc_hash": "93826631d7c2626c464f05aac88a2927ad2bdc6715e71ca5bc0731bca406780c",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "amisto-connect.cc",
                "type": "A",
                "value": "103.224.212.142"
            }
        ],
        "dnssec_valid": false,
        "ip": "103.224.212.142",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2025-10-17T11:05:18Z",
            "updated": "2026-10-18T08:06:50Z",
            "expires": "2027-10-17T11:05:18Z",
            "nameservers": [
                "5014.ns1.abovedomains.com",
                "5014.ns2.abovedomains.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T02:54:04Z",
        "analysis_at": "2026-10-18T17:46:48Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 12,
            "suspicious": 2,
            "undetected": 33
        },
        "detections": {
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "created": "2025-10-17T00:00:00Z",
        "updated": "2025-10-17T00:00:00Z",
        "first_seen": "2025-10-17T13:33:15Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "A",
                "value": "103.224.212.142"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 ip6:fdcf:abda:4154::/48 -all"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.abovedomains.com"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "hostmaster.trellian.com",
                "value": "ns1.abovedomains.com"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "park-mx.above.com",
                "priority": 10
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.abovedomains.com"
            }
        ],
        "dns_at": "2026-10-18T17:52:04Z",
        "jarm": "28d28d28d00028d00042d42d00000051af7d8070a18e002eaaedf620fa118c",
        "cert": {
            "san": [
                "*.18962.net",
                "*.22710.vip",
                "*.25103.vip",
                "*.307-215.top",
                "*.80548.my",
                "*.aitv.now",
                "*.alimenttrust.live",
                "*.amisto-connect.cc",
                "*.balenciagasneaker.us",
                "*.berryvanilla.com"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "680dd46384f639e1ba6a646deff4276fec7",
            "sha256": "d51fb79f4272f6d85fca9b4fbb8b040be8833de87cdcb78484f4e8b51ae6dd3d",
            "subject": "orlandousedautoparts.shop",
            "valid_to": "2027-01-15T18:32:21Z",
            "valid_from": "2026-10-17T18:32:22Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2026-10-17T11:05:18Z",
                "last changed": "2026-10-17T17:01:51Z",
                "registration": "2025-10-17T11:05:18Z",
                "registrar expiration": "2026-10-17T11:05:18Z",
                "last update of RDAP database": "2026-10-17T17:13:18Z"
            },
            "registrar": "DYNADOT LLC",
            "registrar_iana_id": "472"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-21T02:30:40Z",
        "mail_config": {
            "mx": [
                "park-mx.above.com"
            ],
            "spf": "v=spf1 ip6:fdcf:abda:4154::/48 -all",
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "amisto-connect.cc"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-21T02:20:06Z",
            "first": "2026-10-21T02:20:06Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 8708
        },
        "robots_txt": {
            "present": true
        },
        "trackers": {
            "requests": 19,
            "trackers": [
                {
                    "name": "consentmanager",
                    "company": "consentmanager",
                    "country": "SE",
                    "category": "Consent Management",
                    "requests": 8
                },
                {
                    "name": "Microsoft Services",
                    "company": "Microsoft",
                    "country": "US",
                    "category": "Misc",
                    "requests": 1
                },
                {
                    "name": "Microsoft Clarity",
                    "company": "Microsoft",
                    "country": "US",
                    "category": "Site Analytics",
                    "requests": 1
                },
                {
                    "name": "Yahoo!",
                    "company": "Yahoo",
                    "country": "US",
                    "category": "Site Analytics",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://assets.abovedomains.com/javascript/forsale.min.js"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 86,
                "tls": 179,
                "wait": 368,
                "connect": 157,
                "download": 156
            },
            "response_ms": 946
        },
        "tls_connection": {
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80
            ]
        },
        "carbon": {
            "bytes": 27384,
            "co2_grams": 0.001,
            "cleaner_than": 50
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "103.224.212.53",
                    "host": "ns2.abovedomains.com"
                },
                {
                    "ip": "103.224.182.85",
                    "host": "ns1.abovedomains.com"
                }
            ],
            "zone": "amisto-connect.cc"
        },
        "location": {
            "ip": "103.224.212.142",
            "asn": "133618",
            "org": "TRELLIAN",
            "city": "Beaumaris",
            "country": "AU"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "orlandousedautoparts.shop"
        },
        "dns": {
            "A": [
                "103.224.212.142"
            ],
            "MX": [
                "{\"exchange\": \"park-mx.above.com\", \"priority\": 10}"
            ],
            "NS": [
                "ns2.abovedomains.com",
                "ns1.abovedomains.com"
            ],
            "SOA": "{\"nsname\": \"ns1.abovedomains.com\", \"hostmaster\": \"hostmaster.trellian.com\", \"serial\": 2026102113, \"refresh\": 10800, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3600}",
            "TXT": [
                "v=spf1 ip6:fdcf:abda:4154::/48 -all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "103.224.212.142",
            "family": 4
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2025-10-17T11:05:18Z",
            "updated": "2026-10-18T08:06:50Z",
            "expires": "2027-10-17T11:05:18Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "5014.ns1.abovedomains.com",
                "5014.ns2.abovedomains.com"
            ]
        }
    }
}
```