VirusTotal
19 / 92 engine detections · stored summary
Open reportVirusTotalOriginal source recordObserved: 9 fields
Observed: · Retrieved:
| Vendor result counts | {
"timeout": 0,
"harmless": 42,
"malicious": 15,
"suspicious": 4,
"undetected": 31
} |
|---|---|
| Vendor labels | {
"DNS8": "suspicious",
"ESET": "suspicious",
"VIPRE": "phishing",
"G-Data": "phishing",
"Lionic": "phishing",
"Sophos": "phishing",
"CyRadar": "phishing",
"Webroot": "malicious",
"Fortinet": "spam",
"SOCRadar": "phishing",
"URLQuery": "malicious",
"Kaspersky": "phishing",
"LevelBlue": "phishing",
"Seclookup": "malicious",
"Gridinsoft": "suspicious",
"BitDefender": "phishing",
"Chong Lua Dao": "malicious",
"alphaMountain.ai": "phishing",
"Forcepoint ThreatSeeker": "phishing"
} |
| Reputation | 0 |
| Categories | {
"Sophos": "phishing and fraud",
"Webroot": "Phishing and Other Frauds",
"alphaMountain.ai": "Phishing (alphaMountain.ai)",
"Forcepoint ThreatSeeker": "phishing and other frauds"
} |
| First seen | 2026-05-01T13:36:55Z |
| DNS records | [
{
"ttl": 1800,
"type": "MX",
"value": "eforward2.registrar-servers.com",
"priority": 10
},
{
"ttl": 1800,
"type": "MX",
"value": "eforward1.registrar-servers.com",
"priority": 10
},
{
"ttl": 1800,
"type": "NS",
"value": "dns2.registrar-servers.com"
},
{
"ttl": 3601,
"type": "SOA",
"rname": "hostmaster.registrar-servers.com",
"value": "dns1.registrar-servers.com"
},
{
"ttl": 1800,
"type": "NS",
"value": "dns1.registrar-servers.com"
},
{
"ttl": 1800,
"type": "MX",
"value": "eforward5.registrar-servers.com",
"priority": 20
},
{
"ttl": 1800,
"type": "MX",
"value": "eforward3.registrar-servers.com",
"priority": 10
},
{
"ttl": 1800,
"type": "MX",
"value": "eforward4.registrar-servers.com",
"priority": 15
},
{
"ttl": 1800,
"type": "TXT",
"value": "v=spf1 include:spf.efwd.registrar-servers.com ~all"
},
{
"ttl": 1800,
"type": "A",
"value": "94.154.172.92"
}
] |
| Dns at | 2026-10-25T06:27:47Z |
| Jarm | 3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06b |
| Certificate | {
"san": [
"94.154.172.92"
],
"issuer": "Let's Encrypt / YR2",
"serial": "50a6988107e6dd2cd9d41d61bbf67350bd8",
"sha256": "cf50b5651f2296293e87039f0a88b7e957b99b513fb8625daefa3b58ecf8328c",
"valid_to": "2026-09-30T01:17:03Z",
"valid_from": "2026-09-23T09:17:04Z"
} |
Separate source record · 15 malicious + 4 suspicious / 92 · 2026-10-25 06:27:31 UTC
The summary above and this provider record were collected at different times. Both remain available; malicious and suspicious classifications are shown separately.
- record_source
- collected_observations.vt
- analysis_at
- 2026-10-25T06:27:31Z
- fetched_at
- 2026-10-25T15:53:57Z
- stats
- {"timeout":0,"harmless":42,"malicious":15,"suspicious":4,"undetected":31}
