# PhishDestroy domain threat record: blik.kjhg.lol

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/blik.kjhg.lol/
Machine-readable companion: https://phishdestroy.io/domain/blik.kjhg.lol/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 08:31:42 UTC
- Last availability or vendor check: 2026-10-23 11:24:26 UTC
- Stored record updated: 2026-10-23 18:20:49 UTC
- VirusTotal detections in the stored snapshot: 18/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Global Domain Group LLC
- Last stored HTTP status: 200
- Registration date (registry RDAP, kjhg.lol): 2026-09-05 21:39:11 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a167fd-5a26-753c-b3f9-2fbd7979c61b/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/blik.kjhg.lol
- Certificate Transparency search: https://crt.sh/?q=%25.blik.kjhg.lol
- Web Archive lookup: https://web.archive.org/web/*/https://blik.kjhg.lol/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy classifies blik.kjhg.lol as a suspicious domain. The recorded page title is “Płatność kodem BLIK”. The domain was first seen by PhishDestroy on 2026-10-23.

How the scam works
The page claims to handle BLIK code payments, but no credential‑capture form was observed. Suspicious domains may attempt to harvest payment codes, login credentials, or personal data by mimicking legitimate services. Because the site’s behavior was not captured, the exact malicious technique cannot be confirmed.

Evidence
VirusTotal scanned the domain on 2026-10-22 and returned 15 malicious and 3 suspicious detections out of 92 engines, including BitDefender, CRDF, Fortinet and others. Google Safe Browsing checked on 2026-10-23 did not flag the site. URLScan captured the page on 2026-10-23; its overall verdict was clean but its engine marked the URL as malicious with a score of 93. Cloudflare Radar on 2026-10-23 labeled the domain as malware‑related and phishing; OTX reported zero pulses and external blocklists showed no entry as of that date, while PhishDestroy’s internal list marks the domain as blocked.

Infrastructure
The recorded IP address was 188.114.96.3, which belonged to the CloudFLARENET‑EU network recorded in Great Britain. TLS was issued by Google Trust Services for kjhg.lol and *.kjhg.lol, valid from 2026-09-05 to 2026-12-04. The domain age was 32 days and the apex registration was 47 days old at the time of observation. Ports 80, 443 and 8080 were open, and DNSSEC was not enabled.

What to do
Visitors should not enter BLIK codes, passwords or personal data on this site; if they have, they should change any related account credentials immediately. Organizations can block the exact hostname in web filters and monitor for connections to the recorded IP address. Continue to watch threat‑intel feeds for any updates on this domain.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a167fd-5a26-753c-b3f9-2fbd7979c61b/
Cloudflare Radar report: https://radar.cloudflare.com/scan/c89d6e00-39c7-478f-bcb2-901bc7dcbaf1
URLQuery report: https://urlquery.net/report/618a9b55-cc6a-4bd4-aef4-4dd3587bedfa
Stored capture screenshot: https://i.ibb.co/35JB0TWT/160db768eb5e.png
Cloudflare Radar screenshot (2026-10-23T08:39:40Z): https://screenshots.phishdestroy.io/cf/c89d6e00-39c7-478f-bcb2-901bc7dcbaf1.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/618a9b55-cc6a-4bd4-aef4-4dd3587bedfa.png
URLScan screenshot (2026-09-21T18:30:41Z): https://screenshots.phishdestroy.io/us/01a0c53b-9962-761c-9d7d-836ba625968a.png
URLScan capture report: https://urlscan.io/result/01a0c53b-9962-761c-9d7d-836ba625968a/
URLScan screenshot (2026-09-22T10:04:12Z): https://screenshots.phishdestroy.io/us/01a0c892-98c0-7498-8f40-2ded4cbaf7e1.png
URLScan capture report: https://urlscan.io/result/01a0c892-98c0-7498-8f40-2ded4cbaf7e1/
URLScan screenshot (2026-09-24T06:55:52Z): https://screenshots.phishdestroy.io/us/01a0d232-e715-74c6-85dd-436f5bfd1dd6.png
URLScan capture report: https://urlscan.io/result/01a0d232-e715-74c6-85dd-436f5bfd1dd6/
URLScan screenshot (2026-10-23T08:43:35Z): https://screenshots.phishdestroy.io/us/01a167ed-adc9-7200-ae55-53fafe83eff5.png
URLScan capture report: https://urlscan.io/result/01a167ed-adc9-7200-ae55-53fafe83eff5/
URLScan screenshot (2026-10-23T08:54:53Z): https://screenshots.phishdestroy.io/us/01a167f8-3a54-76c5-960c-3391e19943e3.png
URLScan capture report: https://urlscan.io/result/01a167f8-3a54-76c5-960c-3391e19943e3/
VirusTotal report: https://www.virustotal.com/gui/domain/blik.kjhg.lol
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=blik.kjhg.lol
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 09:42:39 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/35JB0TWT/160db768eb5e.png
  Captured: 2026-10-23 09:00:38 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a167fd-5a26-753c-b3f9-2fbd7979c61b.png
  Captured: 2026-10-23 09:00:38 UTC
  Source report: https://urlscan.io/result/01a167fd-5a26-753c-b3f9-2fbd7979c61b/
- URLScan capture 2: https://screenshots.phishdestroy.io/01a0d232-e715-74c6-85dd-436f5bfd1dd6.png
  Captured: 2026-10-23 08:31:42 UTC
  Source report: https://urlscan.io/result/01a167fd-5a26-753c-b3f9-2fbd7979c61b/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c89d6e00-39c7-478f-bcb2-901bc7dcbaf1.png
  Captured: 2026-10-23 08:39:40 UTC
  Source report: https://radar.cloudflare.com/scan/c89d6e00-39c7-478f-bcb2-901bc7dcbaf1
  SHA-256: 7c552ceb134c79d4d3b645c0cebaf072bf04d590d42cdecff65e048b7b20b5c5
- URLQuery: https://screenshots.phishdestroy.io/uq/618a9b55-cc6a-4bd4-aef4-4dd3587bedfa.png
  Source report: https://urlquery.net/report/618a9b55-cc6a-4bd4-aef4-4dd3587bedfa
  SHA-256: 12236fdb4a43cb4c18a365456e59d0cc8e3a7cdfd5f72f4035df6e2f642dac3b
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c53b-9962-761c-9d7d-836ba625968a.png
  Captured: 2026-09-21 18:30:41 UTC
  Source report: https://urlscan.io/result/01a0c53b-9962-761c-9d7d-836ba625968a/
  SHA-256: 4b98041c8f2a92bded6fcae06fb575fd65d9a17c9911cd5034148b833d81f31d
- URLScan · 2026-09-22: https://screenshots.phishdestroy.io/us/01a0c892-98c0-7498-8f40-2ded4cbaf7e1.png
  Captured: 2026-09-22 10:04:12 UTC
  Source report: https://urlscan.io/result/01a0c892-98c0-7498-8f40-2ded4cbaf7e1/
  SHA-256: 03203c082ee34a67d7707b211ae7e90bad53de64db14d4b71564a40971e35d63
- URLScan · 2026-09-24: https://screenshots.phishdestroy.io/us/01a0d232-e715-74c6-85dd-436f5bfd1dd6.png
  Captured: 2026-09-24 06:55:52 UTC
  Source report: https://urlscan.io/result/01a0d232-e715-74c6-85dd-436f5bfd1dd6/
  SHA-256: 03203c082ee34a67d7707b211ae7e90bad53de64db14d4b71564a40971e35d63
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a167ed-adc9-7200-ae55-53fafe83eff5.png
  Captured: 2026-10-23 08:43:35 UTC
  Source report: https://urlscan.io/result/01a167ed-adc9-7200-ae55-53fafe83eff5/
  SHA-256: 03203c082ee34a67d7707b211ae7e90bad53de64db14d4b71564a40971e35d63
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a167f8-3a54-76c5-960c-3391e19943e3.png
  Captured: 2026-10-23 08:54:53 UTC
  Source report: https://urlscan.io/result/01a167f8-3a54-76c5-960c-3391e19943e3/
  SHA-256: 03203c082ee34a67d7707b211ae7e90bad53de64db14d4b71564a40971e35d63

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T09:12:58Z",
        "uuid": "01a167fd-5a26-753c-b3f9-2fbd7979c61b",
        "scanned_at": "2026-10-23T09:00:24Z",
        "final_url": "https://blik.kjhg.lol/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://blik.kjhg.lol/",
                "from": "http://blik.kjhg.lol/",
                "status": 307
            }
        ],
        "ip": "188.114.96.3",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.110.94",
            "2a00:1450:4001:c21::5f",
            "188.114.96.3"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "doc_hash": "eab9d58c4520b1787d0355806282833c8329124304fefeeabb647825c57fdc5c",
        "tls": {
            "san": [
                "kjhg.lol",
                "*.kjhg.lol"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "kjhg.lol",
            "protocol": "QUIC",
            "valid_to": "2026-12-04T21:46:34Z",
            "valid_from": "2026-09-05T20:48:03Z"
        },
        "domain_age_days": 32,
        "apex_age_days": 47,
        "tls_age_days": 47,
        "tls_valid_days": 90,
        "requests": 10,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 93,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T08:42:58Z",
        "uuid": "c89d6e00-39c7-478f-bcb2-901bc7dcbaf1",
        "scanned_at": "2026-10-23T08:39:40Z",
        "final_url": "https://blik.kjhg.lol/",
        "status": 200,
        "history": [
            {
                "url": "https://blik.kjhg.lol/",
                "status": 200
            }
        ],
        "dom_hash": "2d64baa26dcd53e87d565060cacbef536d191eb564229593e08bee73f818e8d7",
        "doc_hash": "6f6ff60c84bbc19e9c8f54d359e27f4e3b4967ca3b6d6088b7c8ab511a12ae95",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "blik.kjhg.lol",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "blik.kjhg.lol",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "blik.kjhg.lol",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            },
            {
                "name": "blik.kjhg.lol",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.97.0",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Global Domain Group LLC",
            "created": "2026-09-05T21:39:11Z",
            "updated": "2026-09-26T15:14:47Z",
            "expires": "2027-09-05T23:59:59Z",
            "nameservers": [
                "fay.ns.cloudflare.com",
                "louis.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T09:40:35Z",
        "analysis_at": "2026-10-22T04:03:39Z",
        "stats": {
            "timeout": 0,
            "harmless": 42,
            "malicious": 15,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "phishing",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "spam",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Global Domain Group LLC",
        "created": "2026-09-05T21:39:11Z",
        "expires": "2027-09-05T23:59:59Z",
        "updated": "2026-09-26T15:14:47Z",
        "first_seen": "2026-09-20T18:11:34Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:d077"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.208.119"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::6815:171e"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.23.30"
            }
        ],
        "dns_at": "2026-10-22T04:09:17Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "kjhg.lol",
                "*.kjhg.lol"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "b53719ac53acf4c513acee0a7dab3a8f",
            "sha256": "a2e2ece6f7a9a08d2a4e17895be92bc0f6869ec25e633ca93ce9423fcb407f3c",
            "subject": "kjhg.lol",
            "valid_to": "2026-12-04T21:46:34Z",
            "valid_from": "2026-09-05T20:48:03Z"
        },
        "whois": {
            "registrar": "Global Domain Group LLC",
            "registrar_iana_id": "3956",
            "registrar_url": "https://www.globaldomaingroup.com",
            "created": "2026-09-05T21:39:11Z",
            "updated": "2026-09-26T15:14:47Z",
            "expires": "2027-09-05T23:59:59Z",
            "status": [
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "fay.ns.cloudflare.com",
                "louis.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T08:43:09Z",
        "caa_records": {
            "domain": "blik.kjhg.lol"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-23T08:34:28Z",
            "first": "2026-10-23T08:34:28Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 8520
        },
        "social_tags": {
            "title": "Płatność kodem BLIK"
        },
        "trackers": {
            "requests": 9,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 7
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 5,
                "tls": 18,
                "wait": 43,
                "connect": 9,
                "download": 0
            },
            "response_ms": 75
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 24442,
            "co2_grams": 0.0009,
            "cleaner_than": 52
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.44.89",
                    "host": "louis.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.58.115",
                    "host": "fay.ns.cloudflare.com"
                }
            ],
            "zone": "kjhg.lol"
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "kjhg.lol"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "AAAA": [
                "2a06:98c1:3121::3",
                "2a06:98c1:3120::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://blik.kjhg.lol"
            ]
        },
        "linked_pages": {
            "internal_count": 5
        },
        "whois": {
            "registrar": "Global Domain Group LLC",
            "created": "2026-09-05T21:39:11Z",
            "updated": "2026-09-26T15:14:47Z",
            "expires": "2027-09-05T23:59:59Z",
            "status": [
                "serverTransferProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "fay.ns.cloudflare.com",
                "louis.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8"
            }
        }
    }
}
```