# PhishDestroy domain threat record: connectnext.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/connectnext.net/
Machine-readable companion: https://phishdestroy.io/domain/connectnext.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-25 03:00:42 UTC
- Stored record updated: 2026-10-25 08:10:22 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 134.122.44.253
- Registrar in stored WHOIS data: PDR Ltd. d/b/a PublicDomainRegistry.com
- Registration date in stored WHOIS data: 2020-05-12 15:52:45 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a139ed-c9f6-7748-b49b-3780b747ac4b/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/connectnext.net
- Certificate Transparency search: https://crt.sh/?q=%25.connectnext.net
- Web Archive lookup: https://web.archive.org/web/*/https://connectnext.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added connectnext.net to its internal blocklist on 2026-10-25. The site returned HTTP 200 with no recorded page title at the time of capture. The listing reflects an automated risk assessment rather than observed malicious activity. A page fetch on 2026-10-25 recorded an HTTP 200 response, indicating the site was reachable at that time.

How the scam works
Vendor detections label the domain as phishing, a category that typically involves presenting a counterfeit login or request page to capture user credentials. No concrete phishing page was captured for this domain, so the precise technique cannot be confirmed. The assessment therefore reflects a potential phishing risk without evidence of a specific exploit.

Evidence
VirusTotal analysis on 2026-10-24 reported 14 malicious and 3 suspicious detections out of 92 engines, totaling 17 flags. Vendors such as BitDefender, ESET, Fortinet and others contributed phishing or malicious labels. Google Safe Browsing checked on 2026-10-25 did not flag the domain. PhishDestroy’s internal blocklist marked it as suspicious on 2026-10-25. OTX listed three pulses referencing the domain on the same day. urlscan captured the site on 2026-10-14, returned an overall clean verdict but its engine scoring marked it malicious with a score of 73. Cloudflare Radar on 2026-10-25 classified the domain as malicious under the malware category.

Infrastructure
The domain was registered on 2020-05-12 through PDR Ltd. d/b/a PublicDomainRegistry.com. The recorded A record pointed to IP 134.122.44.253, which was associated with DigitalOcean, LLC in Canada. Nameservers are ns1.node3389.myfcloud.com, ns2.node3389.myfcloud.com, ns3.mysecurecloudhost.com and ns4.mysecurecloudhost.com. TLS was provided by Let’s Encrypt for the SAN cryotomasyon.com, valid from 2026-10-13 to 2027-01-11.

What to do
Visitors should avoid entering any credentials or personal data on the site and should change passwords if they suspect they may have been entered. Organizations should block connectnext.net at the DNS or proxy level, monitor outbound connections to 134.122.44.253, and review logs for any access attempts. Security teams can add the domain to threat intelligence feeds and continue to monitor VirusTotal and other sources for updates.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a139ed-c9f6-7748-b49b-3780b747ac4b/
Cloudflare Radar report: https://radar.cloudflare.com/scan/fe0f05d1-9d83-4e77-a0a1-ae8775962588
Stored capture screenshot: https://urlscan.io/screenshots/01a139ed-c9f6-7748-b49b-3780b747ac4b.png
Cloudflare Radar screenshot (2026-10-25T03:03:47Z): https://screenshots.phishdestroy.io/cf/fe0f05d1-9d83-4e77-a0a1-ae8775962588.png
URLScan screenshot (2026-10-14T01:46:03Z): https://screenshots.phishdestroy.io/us/01a13816-5cf8-752a-b3be-e86c621e9aa6.png
URLScan capture report: https://urlscan.io/result/01a13816-5cf8-752a-b3be-e86c621e9aa6/
URLScan screenshot (2026-10-25T03:01:14Z): https://screenshots.phishdestroy.io/us/01a17101-39b5-777d-af80-18d4367602bc.png
URLScan capture report: https://urlscan.io/result/01a17101-39b5-777d-af80-18d4367602bc/
URLScan screenshot (2026-10-25T03:04:18Z): https://screenshots.phishdestroy.io/us/01a17104-0a02-747e-acd7-dc7feedcf363.png
URLScan capture report: https://urlscan.io/result/01a17104-0a02-747e-acd7-dc7feedcf363/
VirusTotal report: https://www.virustotal.com/gui/domain/connectnext.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=connectnext.net
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 03:44:07 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a139ed-c9f6-7748-b49b-3780b747ac4b.png
  Captured: 2026-10-25 03:00:42 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a139ed-c9f6-7748-b49b-3780b747ac4b.png
  Captured: 2026-10-25 04:30:49 UTC
  Source report: https://urlscan.io/result/01a139ed-c9f6-7748-b49b-3780b747ac4b/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/fe0f05d1-9d83-4e77-a0a1-ae8775962588.png
  Captured: 2026-10-25 03:03:47 UTC
  Source report: https://radar.cloudflare.com/scan/fe0f05d1-9d83-4e77-a0a1-ae8775962588
  SHA-256: a5db7ab655d3900bfb2bf44f8483ca7ce06fc6f795376f14b777be50f1f0af62
- URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a13816-5cf8-752a-b3be-e86c621e9aa6.png
  Captured: 2026-10-14 01:46:03 UTC
  Source report: https://urlscan.io/result/01a13816-5cf8-752a-b3be-e86c621e9aa6/
  SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17101-39b5-777d-af80-18d4367602bc.png
  Captured: 2026-10-25 03:01:14 UTC
  Source report: https://urlscan.io/result/01a17101-39b5-777d-af80-18d4367602bc/
  SHA-256: 86da70e930109fd51900a0e69631153d1d8014eb557d1172c0c0f43f09d8f52b
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17104-0a02-747e-acd7-dc7feedcf363.png
  Captured: 2026-10-25 03:04:18 UTC
  Source report: https://urlscan.io/result/01a17104-0a02-747e-acd7-dc7feedcf363/
  SHA-256: 86da70e930109fd51900a0e69631153d1d8014eb557d1172c0c0f43f09d8f52b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T03:04:27Z",
        "uuid": "01a139ed-c9f6-7748-b49b-3780b747ac4b",
        "scanned_at": "2026-10-14T10:20:56Z",
        "final_url": "https://connectnext.net/",
        "status": 200,
        "redirected": "https-only",
        "ip": "134.122.44.253",
        "ips": [
            "134.122.44.253"
        ],
        "asns": [
            "14061"
        ],
        "countries": [
            "CA"
        ],
        "doc_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "tls": {
            "san": [
                "connectnext.net"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "connectnext.net",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-11T17:50:08Z",
            "valid_from": "2026-10-13T17:50:09Z"
        },
        "domain_age_days": 1338,
        "apex_age_days": 1338,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 73,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": []
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T03:04:29Z",
        "uuid": "fe0f05d1-9d83-4e77-a0a1-ae8775962588",
        "scanned_at": "2026-10-25T03:03:47Z",
        "final_url": "https://connectnext.net/",
        "history": [
            {
                "url": "https://connectnext.net/",
                "status": 0
            }
        ],
        "dom_hash": "94bfc7c24186e5b245b5675859fb84b248547086370961e5637590177432b219",
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "connectnext.net",
                "type": "A",
                "value": "134.122.44.253"
            }
        ],
        "dnssec_valid": false,
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "PDR Ltd. d/b/a PublicDomainRegistry.com",
            "created": "2020-05-12T17:52:45Z",
            "updated": "2026-10-04T05:05:36Z",
            "expires": "2027-05-12T17:52:45Z",
            "nameservers": [
                "ns1.node3389.myfcloud.com",
                "ns2.node3389.myfcloud.com",
                "ns3.mysecurecloudhost.com",
                "ns4.mysecurecloudhost.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T03:38:55Z",
        "analysis_at": "2026-10-24T04:13:45Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 14,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "created": "2020-05-12T00:00:00Z",
        "first_seen": "2026-10-08T16:03:53Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.mysecurecloudhost.com"
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "134.122.44.253"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns4.mysecurecloudhost.com"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "servers.mysecurecloudhost.com",
                "value": "ns1.mysecurecloudhost.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns3.mysecurecloudhost.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.mysecurecloudhost.com"
            }
        ],
        "dns_at": "2026-10-24T04:19:08Z",
        "jarm": "2ad2ad0002ad2ad00042d42d0000005d86ccb1a0567e012264097a0315d7a7",
        "cert": {
            "san": [
                "cryotomasyon.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "5424557f9192c135a29dd47eefbff66fea2",
            "sha256": "53d6c656e9421ef51574321d5dbb79893e9eca8b57e8cb8c593f153783ea7336",
            "subject": "cryotomasyon.com",
            "valid_to": "2027-01-20T07:03:58Z",
            "valid_from": "2026-10-22T07:03:59Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "last changed": "2026-10-04T05:05:37Z",
                "registration": "2020-05-12T17:52:45Z",
                "registrar expiration": "2027-05-12T17:52:45Z",
                "last update of RDAP database": "2026-10-24T04:19:12Z"
            },
            "registrar": "PDR Ltd. d/b/a PublicDomainRegistry.com",
            "registrar_iana_id": "303"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T03:04:40Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "connectnext.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2017-09-14T07:51:13Z",
            "first": "2007-11-02T07:57:59Z",
            "changes": 2,
            "days_archived": 16,
            "scans_per_day": 0,
            "avg_page_bytes": 1586
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": false,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "99.83.147.209",
                    "host": "ns4.mysecurecloudhost.com"
                },
                {
                    "ip": "13.248.158.180",
                    "host": "ns1.mysecurecloudhost.com"
                },
                {
                    "ip": "75.2.118.134",
                    "host": "ns2.mysecurecloudhost.com"
                },
                {
                    "ip": "76.223.26.245",
                    "host": "ns3.mysecurecloudhost.com"
                }
            ],
            "zone": "connectnext.net"
        },
        "location": {
            "ip": "134.122.44.253",
            "asn": "14061",
            "org": "DigitalOcean, LLC",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "cryotomasyon.com"
        },
        "dns": {
            "A": [
                "134.122.44.253"
            ],
            "NS": [
                "ns2.mysecurecloudhost.com",
                "ns1.mysecurecloudhost.com",
                "ns3.mysecurecloudhost.com",
                "ns4.mysecurecloudhost.com"
            ],
            "SOA": "{\"nsname\": \"ns1.mysecurecloudhost.com\", \"hostmaster\": \"servers.mysecurecloudhost.com\", \"serial\": 2026101206, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "134.122.44.253",
            "family": 4
        },
        "whois": {
            "registrar": "PDR Ltd. d/b/a PublicDomainRegistry.com",
            "created": "2020-05-12T17:52:45Z",
            "updated": "2026-10-04T05:05:36Z",
            "expires": "2027-05-12T17:52:45Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.node3389.myfcloud.com",
                "ns2.node3389.myfcloud.com",
                "ns3.mysecurecloudhost.com",
                "ns4.mysecurecloudhost.com"
            ]
        }
    }
}
```