# PhishDestroy domain threat record: cgregis-au3rdparty.armmosquared.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/cgregis-au3rdparty.armmosquared.com/
Machine-readable companion: https://phishdestroy.io/domain/cgregis-au3rdparty.armmosquared.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-24 05:18:13 UTC
- Last availability or vendor check: 2026-10-25 23:02:24 UTC
- Stored record updated: 2026-10-25 23:21:55 UTC
- VirusTotal detections in the stored snapshot: 19/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 2.59.170.20
- Registrar in stored WHOIS data: NAMECHEAP INC
- Last stored HTTP status: 200
- Registration date (registry RDAP, armmosquared.com): 2025-09-17 20:37:18 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019ff4b8-4463-7229-a2a6-f56242d27dd2/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/cgregis-au3rdparty.armmosquared.com
- Certificate Transparency search: https://crt.sh/?q=%25.cgregis-au3rdparty.armmosquared.com
- Web Archive lookup: https://web.archive.org/web/*/https://cgregis-au3rdparty.armmosquared.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed cgregis-au3rdparty.armmosquared.com as a suspicious domain based on a high number of security‑vendor detections. The domain was first seen by PhishDestroy on 2026-10-24. A page fetch on that date returned HTTP 200 for the exact hostname, but a later urlscan capture from 2026-08-12 showed the HTTPS target responding with HTTP 404 after a 307 redirect. No page title or content was captured, so the assessment relies on external signals rather than observed page behavior.

How the scam works
The listing reflects a generic risk category where domains are flagged for possible phishing, malware distribution, or algorithmically generated (DGA) activity. No specific malicious mechanism was observed on the page itself, so the threat is inferred from the aggregate vendor detections rather than concrete on‑site actions.

Evidence
VirusTotal scanned the domain on 2026-10-22 and reported 19 detections from 92 engines, including 15 malicious and 4 suspicious labels from vendors such as BitDefender, ESET, and Kaspersky. Google Safe Browsing checked on 2026-10-24 and did not flag the domain. urlscan captured the site on 2026-08-12; its engine verdict was malicious with a score of 71 and tags urlscan-ml, while the overall verdict was clean. Cloudflare Radar scanned on 2026-10-24 and marked the domain malicious under the malware category. OTX listed zero pulses as of 2026-10-24, and external blocklists showed no hits. PhishDestroy’s internal blocklist includes the domain.

Infrastructure
The domain was registered less than a week before the first observation (domain age 2 days) and uses TLS certificates issued by Google Trust Services, valid for 90 days from 2026-08-10 to 2026-11-08. A DNS query on 2026-10-24 returned two A records: 2.59.170.20 (associated with WorldStream B.V. in the Netherlands) and 104.219.250.37 (served via Cloudflare). Nameservers are ns1.lander.d.parity.domains and ns2.lander.d.parity.domains, with DNSSEC not enabled.

What to do
Visitors should avoid entering credentials, downloading files, or interacting with any forms on the site; if credentials were submitted, change them immediately. Administrators should block the exact hostname cgregis-au3rdparty.armmosquared.com and monitor outbound connections to the two recorded IP addresses. Security teams can add the domain to internal blocklists and review logs for any recent access attempts.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019ff4b8-4463-7229-a2a6-f56242d27dd2/
Cloudflare Radar report: https://radar.cloudflare.com/scan/d874794e-f809-484e-96fb-7fd9b04b941c
Stored capture screenshot: https://urlscan.io/screenshots/019ff4b8-4463-7229-a2a6-f56242d27dd2.png
Cloudflare Radar screenshot (2026-10-24T05:23:08Z): https://screenshots.phishdestroy.io/cf/d874794e-f809-484e-96fb-7fd9b04b941c.png
VirusTotal report: https://www.virustotal.com/gui/domain/cgregis-au3rdparty.armmosquared.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=cgregis-au3rdparty.armmosquared.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-24 05:26:30 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019ff4b8-4463-7229-a2a6-f56242d27dd2.png
  Captured: 2026-10-24 05:18:13 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d874794e-f809-484e-96fb-7fd9b04b941c.png
  Captured: 2026-10-24 05:23:08 UTC
  Source report: https://radar.cloudflare.com/scan/d874794e-f809-484e-96fb-7fd9b04b941c
  SHA-256: a5db7ab655d3900bfb2bf44f8483ca7ce06fc6f795376f14b777be50f1f0af62

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-24T05:25:38Z",
        "uuid": "019ff4b8-4463-7229-a2a6-f56242d27dd2",
        "scanned_at": "2026-08-12T06:45:50Z",
        "final_url": "https://cgregis-au3rdparty.armmosquared.com/",
        "status": 404,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://cgregis-au3rdparty.armmosquared.com/",
                "from": "http://cgregis-au3rdparty.armmosquared.com/",
                "status": 307
            }
        ],
        "ip": "188.114.97.3",
        "ips": [
            "188.114.97.3"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "globals": [
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass",
            "reloadButtonClick",
            "downloadButtonClick",
            "detailsButtonClick",
            "setAutoFetchState"
        ],
        "tls": {
            "san": [
                "cgregis-au3rdparty.armmosquared.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "cgregis-au3rdparty.armmosquared.com",
            "protocol": "QUIC",
            "valid_to": "2026-11-08T03:16:45Z",
            "valid_from": "2026-08-10T02:16:52Z"
        },
        "domain_age_days": 2,
        "apex_age_days": 327,
        "tls_age_days": 2,
        "tls_valid_days": 90,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 71,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-24T05:25:40Z",
        "uuid": "d874794e-f809-484e-96fb-7fd9b04b941c",
        "scanned_at": "2026-10-24T05:23:08Z",
        "final_url": "https://cgregis-au3rdparty.armmosquared.com/",
        "history": [
            {
                "url": "https://cgregis-au3rdparty.armmosquared.com/",
                "status": 0
            }
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "cgregis-au3rdparty.armmosquared.com",
                "type": "A",
                "value": "104.219.250.37"
            },
            {
                "name": "cgregis-au3rdparty.armmosquared.com",
                "type": "A",
                "value": "2.59.170.20"
            }
        ],
        "dnssec_valid": false,
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2025-09-17T20:37:18Z",
            "updated": "2026-09-18T08:45:52Z",
            "expires": "2027-09-17T20:37:18Z",
            "nameservers": [
                "dns101.registrar-servers.com",
                "dns102.registrar-servers.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-24T05:22:06Z",
        "analysis_at": "2026-10-22T04:05:18Z",
        "stats": {
            "timeout": 0,
            "harmless": 40,
            "malicious": 15,
            "suspicious": 4,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "PREBYTES": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "suspicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "NAMECHEAP INC",
        "created": "2025-09-17T20:37:18Z",
        "expires": "2027-09-17T20:37:18Z",
        "updated": "2026-09-18T08:45:52Z",
        "first_seen": "2026-08-10T03:36:36Z",
        "dns": [
            {
                "ttl": 60,
                "type": "A",
                "value": "104.219.250.37"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns2.lander.d.parity.domains"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns1.lander.d.parity.domains"
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "2.59.170.20"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "hostmaster.lander.d.parity.domains",
                "value": "ns1.lander.d.parity.domains"
            }
        ],
        "dns_at": "2026-10-22T04:11:14Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "cgregis-au3rdparty.armmosquared.com"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "934eb2ec0e4e56a00e90f137c1ec98a7",
            "sha256": "f9357bcf5ed1a2936cdac2dad80419c80e4fd395d98d829588542f95d56d54cc",
            "subject": "cgregis-au3rdparty.armmosquared.com",
            "valid_to": "2026-11-08T03:16:45Z",
            "valid_from": "2026-08-10T02:16:52Z"
        },
        "whois": {
            "registrar": "NAMECHEAP INC",
            "registrar_iana_id": "1068",
            "registrar_url": "http://www.namecheap.com",
            "created": "2025-09-17T20:37:18Z",
            "updated": "1-01-01T00:00:00Z",
            "expires": "2026-09-17T20:37:18Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "dns101.registrar-servers.com",
                "dns102.registrar-servers.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-24T05:26:00Z",
        "caa_records": {
            "domain": "cgregis-au3rdparty.armmosquared.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "192.236.150.131",
                    "host": "ns1.lander.d.parity.domains"
                },
                {
                    "ip": "162.222.205.190",
                    "host": "ns2.lander.d.parity.domains"
                }
            ],
            "zone": "cgregis-au3rdparty.armmosquared.com"
        },
        "location": {
            "ip": "2.59.170.20",
            "asn": "49981",
            "org": "WorldStream B.V.",
            "city": "Naaldwijk",
            "country": "NL"
        },
        "dns": {
            "A": [
                "2.59.170.20",
                "104.219.250.37"
            ],
            "NS": [
                "ns1.lander.d.parity.domains",
                "ns2.lander.d.parity.domains"
            ],
            "SOA": "{\"nsname\": \"ns1.lander.d.parity.domains\", \"hostmaster\": \"hostmaster.lander.d.parity.domains\", \"serial\": 8, \"refresh\": 7200, \"retry\": 3600, \"expire\": 1209600, \"minttl\": 60}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "104.219.250.37",
            "family": 4
        },
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2025-09-17T20:37:18Z",
            "updated": "2026-09-18T08:45:52Z",
            "expires": "2027-09-17T20:37:18Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "dns101.registrar-servers.com",
                "dns102.registrar-servers.com"
            ]
        }
    }
}
```