# PhishDestroy domain threat record: celine-gronek.fr Content language: English Canonical HTML report: https://phishdestroy.io/domain/celine-gronek.fr/ Machine-readable companion: https://phishdestroy.io/domain/celine-gronek.fr/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-27 17:59:47 UTC - Last availability or vendor check: 2026-10-28 00:30:53 UTC - Stored record updated: 2026-10-28 00:30:53 UTC - VirusTotal detections in the stored snapshot: 10/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: gmail ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: OVH - Registrar country in stored WHOIS data: FR - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-01-21 19:03:40 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17e82-fbb2-7652-9ee8-7aa8142bdd1d/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/celine-gronek.fr - Certificate Transparency search: https://crt.sh/?q=%25.celine-gronek.fr - Web Archive lookup: https://web.archive.org/web/*/https://celine-gronek.fr/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s internal analysis classified celine-gronek.fr as a suspicious domain based on multiple malicious detections from security scanners. The domain was first seen by PhishDestroy on 2026-10-27, the recorded page title was “Céline Gronek” and the HTTP response returned 200 at that time. How the scam works The listing reflects a generic risk that domains with several malicious detections may be used for phishing, malware distribution, or credential harvesting, but no concrete malicious functionality was observed on the captured page. No specific scheme such as wallet draining or credential harvesting was identified in the page content. Evidence VirusTotal scanned the domain on 2026-10-27 and reported 10 detections from 92 engines, nine labeled malicious and one suspicious, with vendors including AlphaMountain.ai, BitDefender, Fortinet and others marking it malicious. Google Safe Browsing checked on 2026-10-27 and returned no warning. urlscan.io captured the site on 2026-10-27; its engine flagged the URL as malicious with a score of 8, while the overall verdict was not malicious. OTX listed zero pulses as of 2026-10-27. No external blocklists reported the domain as of 2026-10-27. PhishDestroy added the domain to its internal blocklist on 2026-10-27. Infrastructure The domain was registered on 2026-01-21 through OVH, with client‑transfer and client‑delete protections in place. DNS records resolved to Cloudflare IP addresses 188.114.96.3 and 188.114.97.0, and the network was identified as CloudFLARENET‑EU in Great Britain. The TLS certificate, issued by Google Trust Services, covered the domain and a wildcard subdomain and was valid from 2026-09-15 to 2026-12-14. DNSSEC was not present. Open ports observed during scanning were 80, 443 and 8080. What to do Visitors should avoid entering any credentials or downloading files from the site and change passwords if any information was submitted. Organizations should block the exact domain, monitor network logs for connections to the recorded IP addresses, and add the domain to their threat‑intelligence feeds. Security teams can review authentication attempts related to this address and apply appropriate remediation. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a17e82-fbb2-7652-9ee8-7aa8142bdd1d/ Cloudflare Radar report: https://radar.cloudflare.com/scan/4b652276-2eb2-4915-9709-cd8a9d0e3892 Stored capture screenshot: https://i.ibb.co/20KYFhtx/13aabd036acd.png Cloudflare Radar screenshot (2026-10-27T18:01:18Z): https://screenshots.phishdestroy.io/cf/4b652276-2eb2-4915-9709-cd8a9d0e3892.png URLScan screenshot (2026-09-25T18:30:37Z): https://screenshots.phishdestroy.io/us/01a0d9d4-e8ce-7707-854f-4efbf6fc7968.png URLScan capture report: https://urlscan.io/result/01a0d9d4-e8ce-7707-854f-4efbf6fc7968/ URLScan screenshot (2026-09-28T14:23:11Z): https://screenshots.phishdestroy.io/us/01a0e865-a320-746b-a134-e6a862a31add.png URLScan capture report: https://urlscan.io/result/01a0e865-a320-746b-a134-e6a862a31add/ URLScan screenshot (2026-10-01T18:55:04Z): https://screenshots.phishdestroy.io/us/01a0f8d1-9dd5-73e9-bb6c-c76f228084a6.png URLScan capture report: https://urlscan.io/result/01a0f8d1-9dd5-73e9-bb6c-c76f228084a6/ URLScan screenshot (2026-10-10T06:05:42Z): https://screenshots.phishdestroy.io/us/01a1246a-ab32-76ea-98bd-5467f3739e0a.png URLScan capture report: https://urlscan.io/result/01a1246a-ab32-76ea-98bd-5467f3739e0a/ URLScan screenshot (2026-10-18T12:21:02Z): https://screenshots.phishdestroy.io/us/01a14ef5-2be2-70de-986d-1b2b36b596e7.png URLScan capture report: https://urlscan.io/result/01a14ef5-2be2-70de-986d-1b2b36b596e7/ URLScan screenshot (2026-10-25T19:44:56Z): https://screenshots.phishdestroy.io/us/01a17498-1911-72f0-9310-39f242cb4b01.png URLScan capture report: https://urlscan.io/result/01a17498-1911-72f0-9310-39f242cb4b01/ VirusTotal report: https://www.virustotal.com/gui/domain/celine-gronek.fr Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=celine-gronek.fr Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-27 18:03:01 UTC ## Stored page captures - Primary capture: https://i.ibb.co/20KYFhtx/13aabd036acd.png Captured: 2026-10-27 17:59:47 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a17e82-fbb2-7652-9ee8-7aa8142bdd1d.png Captured: 2026-10-27 17:59:47 UTC Source report: https://urlscan.io/result/01a17e82-fbb2-7652-9ee8-7aa8142bdd1d/ - URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d9d4-e8ce-7707-854f-4efbf6fc7968.png Captured: 2026-09-25 18:30:37 UTC Source report: https://urlscan.io/result/01a0d9d4-e8ce-7707-854f-4efbf6fc7968/ SHA-256: fca028d265b90e60e4726c2f555167be93a8d7af10c0f743215b0987f5eb98ae - URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e865-a320-746b-a134-e6a862a31add.png Captured: 2026-09-28 14:23:11 UTC Source report: https://urlscan.io/result/01a0e865-a320-746b-a134-e6a862a31add/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-10-01: https://screenshots.phishdestroy.io/us/01a0f8d1-9dd5-73e9-bb6c-c76f228084a6.png Captured: 2026-10-01 18:55:04 UTC Source report: https://urlscan.io/result/01a0f8d1-9dd5-73e9-bb6c-c76f228084a6/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a1246a-ab32-76ea-98bd-5467f3739e0a.png Captured: 2026-10-10 06:05:42 UTC Source report: https://urlscan.io/result/01a1246a-ab32-76ea-98bd-5467f3739e0a/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14ef5-2be2-70de-986d-1b2b36b596e7.png Captured: 2026-10-18 12:21:02 UTC Source report: https://urlscan.io/result/01a14ef5-2be2-70de-986d-1b2b36b596e7/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17498-1911-72f0-9310-39f242cb4b01.png Captured: 2026-10-25 19:44:56 UTC Source report: https://urlscan.io/result/01a17498-1911-72f0-9310-39f242cb4b01/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4b652276-2eb2-4915-9709-cd8a9d0e3892.png Captured: 2026-10-27 18:01:18 UTC Source report: https://radar.cloudflare.com/scan/4b652276-2eb2-4915-9709-cd8a9d0e3892 SHA-256: e474a175f992442a69e502e42d7748076f7b37bd4715cf7c03ed2b7ff55231c3 - URLQuery: https://screenshots.phishdestroy.io/uq/94eb2d54-8645-453c-a767-408bb11915ec.png Source report: https://urlquery.net/report/94eb2d54-8645-453c-a767-408bb11915ec SHA-256: 1cae085cf93c8f2c0a9bcbdc4fb84f92692e12202dacadd0a4559d56fa248bca ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-27T18:01:46Z", "uuid": "01a17e82-fbb2-7652-9ee8-7aa8142bdd1d", "scanned_at": "2026-10-27T17:58:08Z", "final_url": "https://celine-gronek.fr/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://celine-gronek.fr/", "from": "http://celine-gronek.fr/", "status": 307 } ], "ip": "172.67.222.63", "domains": [ "campaigntracker.icu", "use.typekit.net", "polygon.drpc.org", "rpc.ankr.com", "polygon-mainnet.public.blastapi.io", "p.typekit.net", "static.cloudflareinsights.com", "interseq.at", "fonts.googleapis.com", "www.amazon.com", "accounts.google.com", "m.facebook.com", "invalid", "trackerredirect.online", "indigo-flicker-zephyr-truior.pro" ], "ips": [ "172.66.146.203", "172.66.164.193", "198.178.224.35", "185.92.183.208", "23.199.55.32", "104.16.80.73", "172.67.130.228", "172.253.115.95", "23.199.55.54", "172.67.222.63" ], "asns": [ "13335", "396356", "56971", "20940", "15169" ], "countries": [ "US", "LV" ], "link_domains": [ "www.linkedin.com", "bestessayhelp.co.uk", "spin-starbet.co.nl", "dida-services.fr" ], "doc_hash": "3000f6484335f3f7ed9479b083255cf08d5e9b6416c39e5243d94412b016a5cb", "script_hashes": [ "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf", "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89", "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8", "268cae8c2e7a7330526dd33b7dadc1bbd08b039bca4acd70390d81a7ef644767", "8d2011a2a7c0d96582f8495b69b6e5f56432ed8b5095cf7aac7e2f259ea2fbfb", "2636846470306c226883fb4ede46a96d71a54454d6c8b1bd9e26e6baf72db965", "b7a27a4b4abfc300eaf7d9151afeef8df2663d98586e38f59f91bbe98ef30af7", "bbfe6403b4ddba29284c72d20f000154d04588d60850fc39a6fd65861c6d83e6", "f9b60ae2f2938c589960ef00d9b9a644f0847f7183f597cdc3fbf8cfe904c552", "34bbd1c367ffc7d80fcff86c7e5f8777e70f4911bb324e8ecfc7dd3604a96e68" ], "globals": [ "CFG_CONFIG", "jQuery", "decode", "getServers", "tryLoadScript", "createDeferredScript", "elementorModules", "elementorFrontendConfig", "__elementorChunks", "__elementorLoadChunk", "elementorFrontend", "Sticky", "wp", "ElementorProFrontendConfig", "__webpack_public_path__", "elementorProFrontend", "_9c58562266", "_wpemojiSettings", "__cfBeacon", "twemoji", "_0x2f27", "_0x359e77", "_0x49c7ea", "_0x1072", "_0x2dca", "_0x5f1a", "__cfCreateProtections", "__cfBoot" ], "cookies": [ "datr", "fr", "sb" ], "storage_keys": [ "elementor", "wpEmojiSettingsSupports" ], "tls": { "san": [ "celine-gronek.fr", "*.celine-gronek.fr" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "celine-gronek.fr", "protocol": "QUIC", "valid_to": "2026-12-14T04:00:11Z", "valid_from": "2026-09-15T03:02:36Z" }, "domain_age_days": 278, "apex_age_days": 278, "tls_age_days": 42, "tls_valid_days": 90, "requests": 77, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 8, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.4.27\nPleskLin" } }, "cf": { "v": 1, "fetched_at": "2026-10-27T18:01:49Z", "uuid": "4b652276-2eb2-4915-9709-cd8a9d0e3892", "scanned_at": "2026-10-27T18:01:18Z", "final_url": "https://celine-gronek.fr/", "status": 200, "history": [ { "url": "https://celine-gronek.fr/", "status": 200 } ], "dom_hash": "819f068e9289d8d12334fc00027edca62d05d8d942bce35ef1bb207e1ba586e9", "doc_hash": "e394f21add51a02722fd430648cc09720a771d2805f4d56e429346c41f9a10aa", "domain_risks": [ "Music", "Entertainment" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "celine-gronek.fr", "type": "A", "value": "188.114.97.0" }, { "name": "celine-gronek.fr", "type": "A", "value": "188.114.96.0" }, { "name": "celine-gronek.fr", "type": "AAAA", "value": "2a06:98c1:3120::" }, { "name": "celine-gronek.fr", "type": "AAAA", "value": "2a06:98c1:3121::" } ], "dnssec_valid": false, "ip": "127.0.1.27", "whois": { "registrar": "OVH", "created": "2026-01-21T20:03:40Z", "updated": "2026-01-26T20:11:32Z", "expires": "2027-01-21T20:03:40Z", "nameservers": [ "emely.ns.cloudflare.com", "jobs.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-27T18:00:50Z", "analysis_at": "2026-10-27T00:44:26Z", "stats": { "timeout": 0, "harmless": 49, "malicious": 9, "suspicious": 1, "undetected": 33 }, "detections": { "CRDF": "malicious", "G-Data": "phishing", "Lionic": "malicious", "Fortinet": "malware", "SOCRadar": "malicious", "Gridinsoft": "suspicious", "MalwareURL": "malware", "BitDefender": "phishing", "alphaMountain.ai": "malicious", "Bfore.Ai PreCrime": "malicious" }, "reputation": -11, "votes": { "malicious": 1 }, "created": "2026-01-21T00:00:00Z", "updated": "2026-01-21T00:00:00Z", "first_seen": "2026-01-21T20:36:41Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.67.222.63" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "emely.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:de3f" }, { "ttl": 300, "type": "A", "value": "104.21.46.15" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::6815:2e0f" }, { "ttl": 21600, "type": "NS", "value": "jobs.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "emely.ns.cloudflare.com" } ], "dns_at": "2026-10-27T01:17:11Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "celine-gronek.fr", "*.celine-gronek.fr" ], "issuer": "Google Trust Services / WE1", "serial": "1ef4f2ef2225cb5213cd6c04e425730d", "sha256": "35407468fe09244ec9d01d510aac4f7e0d0f31b0b9cc14aa726b8a881f931891", "subject": "celine-gronek.fr", "valid_to": "2026-12-14T04:00:11Z", "valid_from": "2026-09-15T03:02:36Z" }, "whois": [], "rdap": { "status": [ "client transfer prohibited", "client delete prohibited" ], "events": { "expiration": "2027-01-21T20:03:40Z", "last changed": "2026-01-26T20:11:32Z", "registration": "2026-01-21T20:03:40Z", "last update of RDAP database": "2026-10-27T01:17:11Z" }, "registrar": "OVH", "registrar_iana_id": "433" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-27T18:02:12Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "celine-gronek.fr" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-27T18:00:16Z", "first": "2026-10-27T18:00:16Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 22550 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://celine-gronek.fr/wp-sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 695 }, "social_tags": { "title": "Céline Gronek", "robots": "max-image-preview:large", "generator": "Elementor 4.3.5; features: e_font_icon_svg, additional_custom_breakpoints; settings: css_print_method-external, google_font-enabled, font_display-swap", "themeColor": "#30334B", "canonicalUrl": "https://celine-gronek.fr/" }, "trackers": { "requests": 76, "trackers": [ { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Adobe Typekit", "company": "Adobe", "country": "US", "category": "Utilities", "requests": 20 } ] }, "mixed_content": { "no_sri": [ "https://indigo-flicker-zephyr-truior.pro/t.js", "https://interseq.at/potok_1/api" ], "third_party_scripts": 2 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 18, "wait": 1597, "connect": 10, "download": 20 }, "response_ms": 1647 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 87894, "co2_grams": 0.0032, "cleaner_than": 25 }, "dns_server": { "ns": [ { "ip": "108.162.193.183", "host": "jobs.ns.cloudflare.com" }, { "ip": "108.162.194.209", "host": "emely.ns.cloudflare.com" } ], "zone": "celine-gronek.fr" }, "location": { "ip": "2a06:98c1:3121::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "celine-gronek.fr" }, "dns": { "A": [ "188.114.97.3", "188.114.96.3" ], "NS": [ "emely.ns.cloudflare.com", "jobs.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"emely.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416267024, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3121::3", "2a06:98c1:3120::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::3", "family": 6 }, "redirects": { "chain": [ "https://celine-gronek.fr" ] }, "tech_stack": { "technologies": [ "WordPress", "MySQL", "PHP", "Hello Elementor", "Elementor", "Typekit", "Twitter Emoji (Twemoji)", "jQuery UI", "jQuery Migrate", "jQuery", "core-js", "Priority Hints", "Google Font API", "Cloudflare", "RSS", "HTTP/3" ] }, "linked_pages": { "external": [ "https://www.linkedin.com/in/c%C3%A9line-gronek-a50541137/", "https://bestessayhelp.co.uk/", "https://spin-starbet.co.nl/", "https://dida-services.fr/" ], "external_count": 4, "internal_count": 7 }, "whois": { "registrar": "OVH", "created": "2026-01-21T20:03:40Z", "updated": "2026-01-26T20:11:32Z", "expires": "2027-01-21T20:03:40Z", "status": [ "clientTransferProhibited", "clientDeleteProhibited" ], "nameservers": [ "emely.ns.cloudflare.com", "jobs.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.4.27, PleskLin" } } } } ```