# PhishDestroy domain threat record: connectdplus.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/connectdplus.com/
Machine-readable companion: https://phishdestroy.io/domain/connectdplus.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-24 18:28:57 UTC
- Last availability or vendor check: 2026-10-24 22:00:27 UTC
- Stored record updated: 2026-10-24 22:31:01 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 144.31.38.47
- Registrar in stored WHOIS data: Atak Domain Bilgi Teknolojileri A.S.
- Last stored HTTP status: 308
- Registration date in stored WHOIS data: 2026-05-28 20:44:01 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a13560-2bcd-720b-af61-ddaa9d0db82f/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/connectdplus.com
- Certificate Transparency search: https://crt.sh/?q=%25.connectdplus.com
- Web Archive lookup: https://web.archive.org/web/*/https://connectdplus.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added connectdplus.com to its internal blocklist on 2026-10-24 based on a trusted automated rule. The page fetch on that date returned a clean overall verdict from urlscan.io, though its engine flagged the URL as malicious with a score of 48. Cloudflare Radar independently labeled the domain as malicious and associated it with malware. No page title or content was recorded, so the assessment relies on external detections rather than observed page behavior.

How the scam works
The available detections suggest the domain may be used for typical malicious activities such as phishing, malware distribution, or command‑and‑control, but no specific technique was observed on the page itself. Without concrete evidence of a particular scheme, the risk is inferred from the aggregate vendor classifications and threat‑intel mentions.

Evidence
VirusTotal scanned the domain on 2026-10-19 and reported 17 detections from 92 engines, including 14 malicious and 3 suspicious labels from vendors such as Dr.Web, BitDefender and ESET. Google Safe Browsing checked the domain on 2026-10-24 and did not flag it. urlscan.io captured a snapshot on 2026-10-13; its machine‑learning engine marked the URL malicious, while the overall verdict was clean. Cloudflare Radar scanned the domain on 2026-10-24 and returned a malicious verdict with a malware category. OTX listed four pulses referencing the domain as of 2026-10-24. PhishDestroy’s internal blocklist marks the domain as suspicious, while external blocklists reported zero matches.

Infrastructure
The domain was registered with Atak Domain Bilgi Teknolojileri A.S. on 2026-05-28, giving it an age of about 149 days at first sighting. The recorded IP was 144.31.38.47 and was listed under the organization Artem Lomakin in Germany. DNS was served by Cloudflare nameservers amanda.ns.cloudflare.com and harlan.ns.cloudflare.com, with no DNSSEC signatures. Open ports observed included 22, 80 and 443.

What to do
Visitors should avoid entering any credentials or personal information on the site; if they have already done so, they should change passwords and monitor accounts for unusual activity. Organizations should add connectdplus.com to their deny lists, monitor DNS queries for the domain, and review logs for connections to the recorded IP address. Continued observation of threat‑intel feeds is recommended to detect any future changes in the domain’s behavior.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a13560-2bcd-720b-af61-ddaa9d0db82f/
Cloudflare Radar report: https://radar.cloudflare.com/scan/1b9b704d-1c64-4c0f-b3d3-659d8b946485
Stored capture screenshot: https://urlscan.io/screenshots/01a13560-2bcd-720b-af61-ddaa9d0db82f.png
Cloudflare Radar screenshot (2026-10-24T18:33:34Z): https://screenshots.phishdestroy.io/cf/1b9b704d-1c64-4c0f-b3d3-659d8b946485.png
URLScan screenshot (2026-08-07T09:48:24Z): https://screenshots.phishdestroy.io/us/019fdb9f-9722-754c-aed7-ae514a8ae5e5.png
URLScan capture report: https://urlscan.io/result/019fdb9f-9722-754c-aed7-ae514a8ae5e5/
VirusTotal report: https://www.virustotal.com/gui/domain/connectdplus.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=connectdplus.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-24 18:36:00 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a13560-2bcd-720b-af61-ddaa9d0db82f.png
  Captured: 2026-10-24 18:28:57 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1b9b704d-1c64-4c0f-b3d3-659d8b946485.png
  Captured: 2026-10-24 18:33:34 UTC
  Source report: https://radar.cloudflare.com/scan/1b9b704d-1c64-4c0f-b3d3-659d8b946485
  SHA-256: a5db7ab655d3900bfb2bf44f8483ca7ce06fc6f795376f14b777be50f1f0af62
- URLScan · 2026-08-07: https://screenshots.phishdestroy.io/us/019fdb9f-9722-754c-aed7-ae514a8ae5e5.png
  Captured: 2026-08-07 09:48:24 UTC
  Source report: https://urlscan.io/result/019fdb9f-9722-754c-aed7-ae514a8ae5e5/
  SHA-256: 0268430f8704418aa129c2cc80c0bd3bfe82f07814866e06d88370dd419618be

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-24T18:35:15Z",
        "uuid": "01a13560-2bcd-720b-af61-ddaa9d0db82f",
        "scanned_at": "2026-10-13T13:07:44Z",
        "final_url": "https://connectdplus.com/",
        "globals": [
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass",
            "reloadButtonClick",
            "downloadButtonClick",
            "detailsButtonClick",
            "setAutoFetchState"
        ],
        "domain_age_days": 137,
        "apex_age_days": 137,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 48,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-24T18:35:17Z",
        "uuid": "1b9b704d-1c64-4c0f-b3d3-659d8b946485",
        "scanned_at": "2026-10-24T18:33:34Z",
        "final_url": "https://connectdplus.com/",
        "history": [
            {
                "url": "https://connectdplus.com/",
                "status": 0
            }
        ],
        "dom_hash": "94bfc7c24186e5b245b5675859fb84b248547086370961e5637590177432b219",
        "domain_risks": [
            "Compromised Domain",
            "Security threats",
            "Malware",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "connectdplus.com",
                "type": "A",
                "value": "144.31.38.47"
            }
        ],
        "dnssec_valid": false,
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Atak Domain Bilgi Teknolojileri A.S.",
            "created": "2026-05-28T22:44:01Z",
            "updated": "2026-10-15T15:05:45Z",
            "expires": "2027-05-28T22:44:01Z",
            "nameservers": [
                "amanda.ns.cloudflare.com",
                "harlan.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-24T18:32:52Z",
        "analysis_at": "2026-10-19T11:53:51Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 14,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "malware",
            "Dr.Web": "malicious",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "malware",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Fewmoretaps OU d/b/a Trustname.com",
        "created": "2026-05-28T22:44:01Z",
        "expires": "2027-05-28T22:44:01Z",
        "updated": "2026-05-28T22:59:34Z",
        "first_seen": "2026-05-28T23:28:39Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "144.31.38.47"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "amanda.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "amanda.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "harlan.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-19T11:59:08Z",
        "jarm": "27d3fd40d29d29d00042d43d00000026a95928fa9b620834c2feff40bccb8f",
        "cert": {
            "issuer": "VK / VK interm CA",
            "serial": "724791a0bb85ea47683bf75d06f47791e0571781",
            "sha256": "13a44185ca43adc21ebc769f88545d90c3168022fc09d0e325385212066d1725",
            "subject": "www.vk",
            "valid_to": "2052-08-24T15:25:19Z",
            "valid_from": "2022-07-13T15:25:19Z"
        },
        "whois": {
            "registrar": "Fewmoretaps OU d/b/a Trustname.com",
            "registrar_iana_id": "4318",
            "registrar_url": "https://trustname.com/",
            "created": "2026-05-28T22:44:01Z",
            "updated": "2026-05-28T22:59:34Z",
            "expires": "2027-05-28T22:44:01Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "amanda.ns.cloudflare.com",
                "harlan.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "expiration": "2027-05-28T00:00:00Z",
                "last changed": "2026-10-17T07:51:58Z",
                "registration": "2026-05-28T00:00:00Z",
                "registrar expiration": "2027-05-28T00:00:00Z",
                "last update of RDAP database": "2026-10-17T07:51:58Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-24T18:35:36Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "connectdplus.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "173.245.58.63",
                    "host": "amanda.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.35.250",
                    "host": "harlan.ns.cloudflare.com"
                }
            ],
            "zone": "connectdplus.com"
        },
        "location": {
            "ip": "144.31.38.47",
            "asn": "199566",
            "org": "Artem Lomakin",
            "city": "Falkenstein",
            "country": "DE"
        },
        "dns": {
            "A": [
                "144.31.38.47"
            ],
            "NS": [
                "amanda.ns.cloudflare.com",
                "harlan.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"amanda.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415692696, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "144.31.38.47",
            "family": 4
        },
        "whois": {
            "registrar": "Atak Domain Bilgi Teknolojileri A.S.",
            "created": "2026-05-28T22:44:01Z",
            "updated": "2026-10-15T15:05:45Z",
            "expires": "2027-05-28T22:44:01Z",
            "status": [
                "ok https://icann.org/epp"
            ],
            "nameservers": [
                "amanda.ns.cloudflare.com",
                "harlan.ns.cloudflare.com"
            ]
        }
    }
}
```