# cloudfiare-verification.cc — Recorded security evidence | PhishDestroy
Content language: English
Canonical HTML report: https://phishdestroy.io/domain/cloudfiare-verification.cc/
Machine-readable companion: https://phishdestroy.io/domain/cloudfiare-verification.cc/llm.txt
## Summary
PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.
## Stored observations
- Listed by PhishDestroy: yes
- Availability at last stored check: Last known active
- First observed by PhishDestroy: 2026-11-12 04:01:33 UTC
- Selected availability observation: 2026-11-11T21:06:49Z
- Stored record updated: 2026-11-12 04:07:35 UTC
- VirusTotal detections in the stored snapshot: 9/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: checked_clean
## Stored labels and detections
- Automated brand label (collector metadata; not a confirmed impersonation finding): Cloudflare
## Stored infrastructure
- Observed IP address: 172.67.193.188
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 200 (observed: not recorded)
- Registration date in stored WHOIS data: 2026-11-08 18:16:54 UTC
## Evidence links
- URLScan report: https://urlscan.io/result/01a1cc6e-f030-7730-98b1-d9f27b5e5463/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/cloudfiare-verification.cc
- Certificate Transparency search: https://crt.sh/?q=%25.cloudfiare-verification.cc
- Web Archive lookup: https://web.archive.org/web/*/https://cloudfiare-verification.cc/
## Corrections
- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq
## Public report package
PhishDestroy stores a record for cloudfiare-verification.cc. Source observations are dated separately; missing checks do not establish safety.
PhishDestroy stores a record for cloudfiare-verification.cc. Source observations are dated separately; missing checks do not establish safety.
A reviewed analysis is not available for this text revision. Consult the dated source records below.
Package revision: 848e5c85ca96226eb1ee94479d71b08e438699b448b57eda726e2b629f859a9f
Source facts (timestamps as stored): {"record_id":1932671,"first_recorded_at":"2026-11-12 05:01:33","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":9,"denominator":92,"malicious":7,"suspicious":2,"vendors":{"CRDF":"malicious","G-Data":"malware","Lionic":"malicious","Fortinet":"malware","SOCRadar":"malicious","Gridinsoft":"suspicious","BitDefender":"malware","alphaMountain.ai":"suspicious","Forcepoint ThreatSeeker":"malicious"},"observed_at":"2026-11-12T01:37:48Z","checked_at":null,"fetched_at":"2026-11-12T04:04:49Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":9,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","BitDefender","CRDF","Forcepoint ThreatSeeker","Fortinet","G-Data","Gridinsoft","Lionic","SOCRadar"],"observed_at":"2026-11-12 01:37:48","checked_at":"2026-11-12 05:04:49","fetched_at":"2026-11-12 04:04:50","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"CRDF":"malicious","G-Data":"malware","Lionic":"malicious","Fortinet":"malware","SOCRadar":"malicious","Gridinsoft":"suspicious","BitDefender":"malware","alphaMountain.ai":"suspicious","Forcepoint ThreatSeeker":"malicious"},"vendor_names":["CRDF","G-Data","Lionic","Fortinet","SOCRadar","Gridinsoft","BitDefender","alphaMountain.ai","Forcepoint ThreatSeeker"],"stats":{"timeout":0,"harmless":49,"malicious":7,"suspicious":2,"undetected":34}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-12 05:04:51"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":null},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"URLScan","record_id":1932671,"scope":"checked_url","observed_at":"2026-11-11T21:06:49Z","http_status":200,"http_observed_at":"2026-11-11T21:06:49Z","stored_http_code":200,"stored_http_observed_at":null,"legacy_site_status":"unknown","supports_outcome_badge":false,"content_classification":"unknown","content_classification_at":null,"registration_state":"unknown","policy":"20261102-dated-availability-v2","scan_uuid":"01a1cc6e-f030-7730-98b1-d9f27b5e5463","fetched_at":"2026-11-12T04:07:04Z"}}
## Stored page captures
- URLScan · 2026-11-11 · via cupidlovestories.com: https://screenshots.phishdestroy.io/us/01a1cc6e-f030-7730-98b1-d9f27b5e5463.png
Captured: 2026-11-11 21:06:49 UTC
Source report: https://urlscan.io/result/01a1cc6e-f030-7730-98b1-d9f27b5e5463/
SHA-256: 69851a3e7b0fc85a031b0bc5eae3ffc5b8a8da5daa82c45b9eb23e06fba34b4d
- URLScan · 2026-11-10: https://screenshots.phishdestroy.io/us/01a1c6fa-a6ff-73f2-a37f-b4d0c4e67561.png
Captured: 2026-11-10 19:41:23 UTC
Source report: https://urlscan.io/result/01a1c6fa-a6ff-73f2-a37f-b4d0c4e67561/
SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599
- URLScan · 2026-11-11: https://screenshots.phishdestroy.io/us/01a1cb1b-cb7a-72c5-b10e-92ac4dbe586d.png
Captured: 2026-11-11 14:56:06 UTC
Source report: https://urlscan.io/result/01a1cb1b-cb7a-72c5-b10e-92ac4dbe586d/
SHA-256: 2596a1fdf7e3758a189bf5aae24f065f27025df77bcf873dd47c7bd32095ab70
- URLScan · 2026-11-11: https://screenshots.phishdestroy.io/us/01a1cb89-a673-70bd-9e45-8a09c97719f1.png
Captured: 2026-11-11 16:56:08 UTC
Source report: https://urlscan.io/result/01a1cb89-a673-70bd-9e45-8a09c97719f1/
SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599
- URLScan · 2026-11-12: https://screenshots.phishdestroy.io/us/01a1cdeb-602c-7278-89a3-dfc9fea1dee5.png
Captured: 2026-11-12 04:02:09 UTC
Source report: https://urlscan.io/result/01a1cdeb-602c-7278-89a3-dfc9fea1dee5/
SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f288d361-215b-41e1-9259-8d302e473a1a.png
Captured: 2026-11-12 04:05:29 UTC
Source report: https://radar.cloudflare.com/scan/f288d361-215b-41e1-9259-8d302e473a1a
SHA-256: 2b1bad812b9cd100e00382b2439a1713b1aba2b94ea4a85ddd3b69e8528bd584
## Collected source observations
Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
"urlscan": {
"v": 1,
"fetched_at": "2026-11-12T04:07:04Z",
"uuid": "01a1cc6e-f030-7730-98b1-d9f27b5e5463",
"scanned_at": "2026-11-11T21:06:49Z",
"final_url": "https://cloudfiare-verification.cc/",
"status": 200,
"redirected": "off-domain",
"redirects": [
{
"to": "https://cupidlovestories.com/",
"from": "http://cupidlovestories.com/",
"status": 307
},
{
"to": "http://cupidlovestories.com/",
"from": "https://cupidlovestories.com/",
"status": 307
},
{
"to": "https://cupidlovestories.com/",
"from": "http://cupidlovestories.com/",
"status": 301
},
{
"to": "https://wexalon.online/",
"from": "https://cupidlovestories.com/"
},
{
"to": "https://cloudfiare-verification.cc/",
"from": "https://wexalon.online/",
"status": 307
}
],
"ip": "104.21.12.70",
"domains": [
"cupidlovestories.com",
"fonts.gstatic.com",
"fonts.googleapis.com",
"www.googletagmanager.com",
"hgweggvfe.com",
"wexalon.online",
"shatamilo.com",
"www.google.nl",
"stats.g.doubleclick.net",
"region1.analytics.google.com",
"sainbroissilver.pro"
],
"ips": [
"185.7.214.119",
"104.21.8.42",
"104.21.12.70",
"188.114.96.3",
"142.251.20.94",
"192.178.183.97",
"142.251.20.95",
"92.113.16.226",
"92.113.16.247"
],
"asns": [
"55286",
"13335",
"15169",
"47583"
],
"countries": [
"GB",
"US",
"DE"
],
"doc_hash": "9622a4c11b7c392a363fc97599d99866768ea11f680ae7b137dbf4e5a7f3c46e",
"cookies": [
"PHPSESSID",
"_ga",
"_ga_E29ZJC9GW8"
],
"tls": {
"san": [
"cupidlovestories.com",
"www.cupidlovestories.com"
],
"cipher": "AES_128_GCM",
"issuer": "YE1",
"subject": "cupidlovestories.com",
"protocol": "TLS 1.3",
"valid_to": "2027-01-12T06:09:35Z",
"valid_from": "2026-10-14T06:09:36Z"
},
"domain_age_days": 3,
"apex_age_days": 3,
"tls_age_days": 3,
"tls_valid_days": 89,
"requests": 86,
"verdicts": {
"engines": {
"tags": [
"urlscan-ml",
"urlscan-ml-2aab354"
],
"score": 95,
"malicious": true
},
"overall": {
"score": 0,
"malicious": false
}
},
"headers": {
"server": "hcdn",
"content-type": "text/html; charset=UTF-8",
"x-powered-by": "PHP/8.2.35",
"strict-transport-security": "max-age=31536000",
"content-security-policy": "upgrade-insecure-requests;",
"link": "; rel=\"https://api.w.org/\"\n; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\"\n200000"
},
"dns": [
{
"name": "cloudfiare-verification.cc",
"type": "A",
"value": "104.21.12.70"
},
{
"name": "cloudfiare-verification.cc",
"type": "A",
"value": "172.67.193.188"
},
{
"name": "cloudfiare-verification.cc",
"type": "AAAA",
"value": "2606:4700:3035::6815:c46"
},
{
"name": "cloudfiare-verification.cc",
"type": "AAAA",
"value": "2606:4700:3035::ac43:c1bc"
}
],
"dnssec_valid": false,
"ip": "104.21.12.70",
"verdict": {
"tags": [
"malware",
"brand embedding"
],
"malicious": true,
"categories": [
"malware",
"brand embedding"
]
},
"whois": {
"registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
"created": "2026-11-08T19:16:54Z",
"updated": "2026-11-08T19:16:54Z",
"expires": "2027-11-08T19:16:54Z",
"nameservers": [
"ezra.ns.cloudflare.com",
"meiling.ns.cloudflare.com"
]
}
},
"vt": {
"v": 1,
"fetched_at": "2026-11-12T04:04:49Z",
"analysis_at": "2026-11-12T01:37:48Z",
"stats": {
"timeout": 0,
"harmless": 49,
"malicious": 7,
"suspicious": 2,
"undetected": 34
},
"detections": {
"CRDF": "malicious",
"G-Data": "malware",
"Lionic": "malicious",
"Fortinet": "malware",
"SOCRadar": "malicious",
"Gridinsoft": "suspicious",
"BitDefender": "malware",
"alphaMountain.ai": "suspicious",
"Forcepoint ThreatSeeker": "malicious"
},
"reputation": -11,
"votes": {
"malicious": 1
},
"tags": [
"dga"
],
"categories": {
"alphaMountain.ai": "Suspicious, Newly Registered (alphaMountain.ai)",
"Forcepoint ThreatSeeker": "suspicious content"
},
"registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
"created": "2026-11-08T19:16:54Z",
"expires": "2027-11-08T19:16:54Z",
"updated": "2026-11-08T19:16:54Z",
"first_seen": "2026-11-08T21:12:32Z",
"dns": [
{
"ttl": 300,
"type": "A",
"value": "172.67.193.188"
},
{
"ttl": 21600,
"type": "NS",
"value": "ezra.ns.cloudflare.com"
},
{
"ttl": 1800,
"type": "SOA",
"rname": "dns.cloudflare.com",
"value": "ezra.ns.cloudflare.com"
},
{
"ttl": 300,
"type": "AAAA",
"value": "2606:4700:3035::ac43:c1bc"
},
{
"ttl": 21600,
"type": "NS",
"value": "meiling.ns.cloudflare.com"
},
{
"ttl": 300,
"type": "AAAA",
"value": "2606:4700:3035::6815:c46"
},
{
"ttl": 300,
"type": "A",
"value": "104.21.12.70"
}
],
"dns_at": "2026-11-12T01:38:00Z",
"jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
"cert": {
"san": [
"*.cloudfiare-verification.cc",
"cloudfiare-verification.cc"
],
"issuer": "Let's Encrypt / YE1",
"serial": "523d3e47ca1f6f8b409dd800d73501f8f9a",
"sha256": "12e09ef1b6160c58371ac710ae203969e80ab38e90f879d67bdceb1f6b3bed55",
"subject": "cloudfiare-verification.cc",
"valid_to": "2027-02-06T18:21:40Z",
"valid_from": "2026-11-08T18:21:41Z",
"observed_at": "2026-11-12T01:38:00Z"
},
"whois": {
"registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
"registrar_iana_id": "3765",
"registrar_url": "https://nicenic.com",
"created": "2026-11-08T19:16:54Z",
"updated": "2026-11-08T19:16:54Z",
"expires": "2027-11-08T19:16:54Z",
"status": [
"clientDeleteProhibited",
"clientTransferProhibited"
],
"nameservers": [
"ezra.ns.cloudflare.com",
"meiling.ns.cloudflare.com"
],
"dnssec": "unsigned"
},
"rdap": {
"status": [
"client delete prohibited",
"client transfer prohibited"
],
"events": {
"expiration": "2027-11-08T19:16:54Z",
"registration": "2026-11-08T19:16:54Z",
"registrar expiration": "2027-11-08T19:16:54Z",
"last update of RDAP database": "2026-11-08T21:12:32Z"
}
}
},
"webcheck": {
"v": 1,
"fetched_at": "2026-11-12T04:07:27Z",
"mail_config": {
"spf_lookups": 0
},
"block_lists": {
"resolvers": 12,
"blocked_by": [
"CloudFlare Family"
],
"blocked_count": 1
},
"trackers": {
"requests": 2
},
"mixed_content": {
"third_party_scripts": 0
},
"status": {
"up": true,
"code": 200,
"timings": {
"dns": 2,
"tls": 46,
"wait": 75,
"connect": 6,
"download": 0
},
"response_ms": 129
},
"tls_connection": {
"alpn": "h2",
"cipher": "TLS_AES_256_GCM_SHA384",
"protocol": "TLSv1.3",
"versions": [
"TLSv1",
"TLSv1.1",
"TLSv1.2",
"TLSv1.3"
],
"authorized": true,
"forward_secrecy": true
},
"ports": {
"open": [
80,
443,
8080
]
},
"carbon": {
"bytes": 823,
"co2_grams": 0,
"cleaner_than": 95
},
"dns_server": {
"ns": [
{
"ip": "108.162.194.254",
"host": "meiling.ns.cloudflare.com"
},
{
"ip": "172.64.35.15",
"host": "ezra.ns.cloudflare.com"
}
],
"zone": "cloudfiare-verification.cc"
},
"location": {
"ip": "2606:4700:3035::6815:c46",
"asn": "13335",
"org": "Cloudflare, Inc.",
"city": "San Francisco",
"country": "US"
},
"ssl": {
"issuer": "Let's Encrypt / YE1",
"subject": "cloudfiare-verification.cc"
},
"dns": {
"A": [
"104.21.12.70",
"172.67.193.188"
],
"NS": [
"meiling.ns.cloudflare.com",
"ezra.ns.cloudflare.com"
],
"SOA": "{\"nsname\": \"ezra.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2419651315, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
"AAAA": [
"2606:4700:3035::ac43:c1bc",
"2606:4700:3035::6815:c46"
]
},
"dnssec": {
"ds": false,
"rrsig": false,
"dnskey": false
},
"hsts": {
"message": "Site does not serve any HSTS headers."
},
"http_security": {
"xFrameOptions": false,
"referrerPolicy": false,
"xXSSProtection": false,
"permissionsPolicy": false,
"xContentTypeOptions": false,
"contentSecurityPolicy": false,
"strictTransportPolicy": false,
"crossOriginOpenerPolicy": false,
"crossOriginEmbedderPolicy": false,
"crossOriginResourcePolicy": false
},
"firewall": {
"waf": "Cloudflare",
"has_waf": true
},
"get_ip": {
"ip": "2606:4700:3035::6815:c46",
"family": 6
},
"redirects": {
"chain": [
"https://cloudfiare-verification.cc"
]
},
"tech_stack": {
"technologies": [
"Cloudflare",
"HTTP/3"
]
},
"whois": {
"registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
"created": "2026-11-08T19:16:54Z",
"updated": "2026-11-08T19:16:54Z",
"expires": "2027-11-08T19:16:54Z",
"status": [
"clientDeleteProhibited https://icann.org/epp",
"clientTransferProhibited https://icann.org/epp"
],
"nameservers": [
"ezra.ns.cloudflare.com",
"meiling.ns.cloudflare.com"
]
},
"headers": {
"headers": {
"server": "cloudflare",
"content-type": "text/html"
}
}
}
}
```
## Complete dated records
Availability observations: https://phishdestroy.io/domain/cloudfiare-verification.cc/records.json?source=availability&format=json
Source observation history: https://phishdestroy.io/domain/cloudfiare-verification.cc/records.json?source=detections&format=json
PhishStats records: https://phishdestroy.io/domain/cloudfiare-verification.cc/records.json?source=phishstats&format=json
Sent report records: https://phishdestroy.io/domain/cloudfiare-verification.cc/records.json?source=sent_reports&format=json
Report history: https://phishdestroy.io/domain/cloudfiare-verification.cc/records.json?source=report_history&format=json
Repeat report records: https://phishdestroy.io/domain/cloudfiare-verification.cc/records.json?source=rereports&format=json
Follow-up records: https://phishdestroy.io/domain/cloudfiare-verification.cc/records.json?source=followups&format=json
Content observations: https://phishdestroy.io/domain/cloudfiare-verification.cc/records.json?source=content&format=json
## Dated availability observation
Latest stored reachability observation
```json
{
"state": "alive",
"label_key": "availability.active",
"detail_key": "detail.latest_reachability",
"params": [],
"source": "URLScan",
"record_id": 1932671,
"scope": "checked_url",
"observed_at": "2026-11-11T21:06:49Z",
"http_status": 200,
"http_observed_at": "2026-11-11T21:06:49Z",
"stored_http_code": 200,
"stored_http_observed_at": null,
"legacy_site_status": "unknown",
"supports_outcome_badge": false,
"content_classification": "unknown",
"content_classification_at": null,
"registration_state": "unknown",
"policy": "20261102-dated-availability-v2",
"scan_uuid": "01a1cc6e-f030-7730-98b1-d9f27b5e5463",
"fetched_at": "2026-11-12T04:07:04Z"
}
```