# PhishDestroy domain threat record: crownfacilitys.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/crownfacilitys.com/ Machine-readable companion: https://phishdestroy.io/domain/crownfacilitys.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 01:44:14 UTC - Last availability or vendor check: 2026-10-26 11:00:40 UTC - Stored record updated: 2026-10-26 19:21:25 UTC - VirusTotal detections in the stored snapshot: 6/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 192.169.80.42 - Registrar in stored WHOIS data: Squarespace Domains LLC - Registrar country in stored WHOIS data: US - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-08-03 15:30:28 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17093-558d-7520-bb1a-96d532cb4388/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/crownfacilitys.com - Certificate Transparency search: https://crt.sh/?q=%25.crownfacilitys.com - Web Archive lookup: https://web.archive.org/web/*/https://crownfacilitys.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed crownfacilitys.com as a suspicious domain based on automated threat scoring. The recorded page title was "Início — Crown Facility Services" and the site returned HTTP 200 on the check performed on 2026-10-25. The domain was first seen by PhishDestroy on 2026-10-25, 83 days after its registration on 2026-08-03. How the scam works The classification reflects that several security vendors flagged the domain as malicious or phishing‑related, a pattern often used to lure users into revealing credentials or personal data. No concrete malicious behavior was observed on the captured page, so the exact scam technique cannot be confirmed. Evidence VirusTotal scanned the domain on 2026-10-20 (analysis) and again on 2026-10-25, reporting six detections from 92 engines, including four malicious labels from CRDF, DNS8, Forcepoint ThreatSeeker and Gridinsoft and two suspicious labels. Google Safe Browsing checked on 2026-10-25 and returned no warning. urlscan captured the site on 2026-10-16; its overall verdict was clean, but its engine score flagged the page as malicious with a 92‑point confidence. OTX listed zero pulses as of 2026-10-25, external blocklists had no entries for the domain on that date, and PhishDestroy’s internal blocklist marked it as malicious. Infrastructure The domain was registered with Squarespace Domains LLC on 2026-08-03, with the nameservers ns1.serverbrasil.com.br and ns2.serverbrasil.com.br. The recorded IP was 192.169.80.42, associated with Limestone Networks in the United States, and the site presented a Let's Encrypt TLS certificate valid until 2027-01-01. Port scans on 2026-10-25 observed open services on ports 25, 53, 80, 110, 143, 443, 587, 993, 995, 3306 and 8888. What to do Visitors should avoid entering any credentials or personal information on the site; if they have already done so, they should change any used passwords immediately. Organizations can add crownfacilitys.com to DNS and web filtering policies and monitor for traffic to the recorded IP address. Security teams should review access logs for connections to 192.169.80.42 and treat the domain as potentially malicious. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a144da-b89e-71f0-95a3-9d5bb42f8d5f/ Cloudflare Radar report: https://radar.cloudflare.com/scan/867d365e-1c65-4ff8-bc8c-645d69f15e0d Stored capture screenshot: https://urlscan.io/screenshots/01a144da-b89e-71f0-95a3-9d5bb42f8d5f.png Cloudflare Radar screenshot (2026-10-25T00:51:56Z): https://screenshots.phishdestroy.io/cf/867d365e-1c65-4ff8-bc8c-645d69f15e0d.png URLScan screenshot (2026-08-05T08:17:12Z): https://screenshots.phishdestroy.io/us/019fd0ff-5d0c-72ac-9220-f777ae967fa1.png URLScan capture report: https://urlscan.io/result/019fd0ff-5d0c-72ac-9220-f777ae967fa1/ VirusTotal report: https://www.virustotal.com/gui/domain/crownfacilitys.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=crownfacilitys.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 01:58:36 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a17093-558d-7520-bb1a-96d532cb4388.png Captured: 2026-10-25 01:03:07 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a144da-b89e-71f0-95a3-9d5bb42f8d5f.png Captured: 2026-10-25 01:44:14 UTC Source report: https://urlscan.io/result/01a17093-558d-7520-bb1a-96d532cb4388/ - URLScan · 2026-08-05: https://screenshots.phishdestroy.io/us/019fd0ff-5d0c-72ac-9220-f777ae967fa1.png Captured: 2026-08-05 08:17:12 UTC Source report: https://urlscan.io/result/019fd0ff-5d0c-72ac-9220-f777ae967fa1/ SHA-256: 2781987e2e0ec1725f3620b6404402c005465ab96ac1efb69e862f0f5b8a7a17 - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a170a2-43af-752e-a486-e71dc0660647.png Captured: 2026-10-25 01:17:57 UTC Source report: https://urlscan.io/result/01a170a2-43af-752e-a486-e71dc0660647/ SHA-256: c933337a14b29b5eae09d6453dbfea6e8819dac9090e72a53c88cbd096139490 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/867d365e-1c65-4ff8-bc8c-645d69f15e0d.png Captured: 2026-10-25 00:51:56 UTC Source report: https://radar.cloudflare.com/scan/867d365e-1c65-4ff8-bc8c-645d69f15e0d SHA-256: e2609a0c1b72dd7b811f4f128f4ca5447353c9e5cc3ea7f5568884b4bcfe7470 - URLQuery: https://screenshots.phishdestroy.io/uq/b3a3394b-35be-45ee-aca1-540446261ae3.png Source report: https://urlquery.net/report/b3a3394b-35be-45ee-aca1-540446261ae3 SHA-256: c0392ffe763941c04c3cc286d1e592c84be2497948d4f37afb5a508dd1c27c8d - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a144da-b89e-71f0-95a3-9d5bb42f8d5f.png Captured: 2026-10-16 13:15:55 UTC Source report: https://urlscan.io/result/01a144da-b89e-71f0-95a3-9d5bb42f8d5f/ SHA-256: cfb2957f28d9bd056b6bf071d24c66458771374368afd13da00f588a2667eae3 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T01:03:41Z", "uuid": "01a17093-558d-7520-bb1a-96d532cb4388", "scanned_at": "2026-10-25T01:01:17Z", "final_url": "https://crownfacilitys.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://crownfacilitys.com/", "from": "http://crownfacilitys.com/", "status": 307 } ], "ip": "192.169.80.42", "ptr": "server9.servhost.com.br", "domains": [ "cdn.tailwindcss.com", "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "142.250.195.99", "142.250.183.42", "172.67.68.11", "192.169.80.42" ], "asns": [ "15169", "13335", "46475" ], "countries": [ "US" ], "doc_hash": "8a4242a6678eda481adbc54ddf15ba2e5eb537459992609be3f29a144c76e31e", "script_hashes": [ "cfca304dc87a8a81e4fd763e5ef81c360db40e2f81ae6a7b9ba7536abb4011f1" ], "globals": [ "tailwind", "/template.html" ], "cookies": [ "cms_session" ], "tls": { "san": [ "*.crownfacilitys.com", "crownfacilitys.com" ], "cipher": "AES_256_GCM", "issuer": "YR1", "subject": "*.crownfacilitys.com", "protocol": "TLS 1.3", "valid_to": "2027-01-01T17:08:18Z", "valid_from": "2026-10-03T17:08:19Z" }, "domain_age_days": 82, "apex_age_days": 82, "tls_age_days": 21, "tls_valid_days": 89, "requests": 21, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 91, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html; charset=UTF-8", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T00:58:00Z", "uuid": "867d365e-1c65-4ff8-bc8c-645d69f15e0d", "scanned_at": "2026-10-25T00:51:56Z", "final_url": "https://crownfacilitys.com/", "status": 200, "history": [ { "url": "https://crownfacilitys.com/", "status": 200 } ], "dom_hash": "d3b0c18fe3cb93650a6b55841b27f9b650d6678c40d65ec8784e8b2525172331", "doc_hash": "256cc8b092d1bdd734d87a941b1d61259d9a80a389bd59f9c232c340d2b61230", "domain_risks": [ "Business", "Business & Economy" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "crownfacilitys.com", "type": "A", "value": "192.169.80.42" } ], "dnssec_valid": false, "ip": "192.169.80.42", "whois": { "registrar": "Squarespace Domains LLC", "created": "2026-08-03T17:30:28Z", "updated": "2026-08-03T17:33:25Z", "expires": "2027-08-03T17:30:28Z", "nameservers": [ "ns1.serverbrasil.com.br", "ns2.serverbrasil.com.br" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T00:49:45Z", "analysis_at": "2026-10-20T13:35:07Z", "stats": { "timeout": 0, "harmless": 51, "malicious": 4, "suspicious": 2, "undetected": 35 }, "detections": { "CRDF": "malicious", "DNS8": "phishing", "Fortinet": "spam", "Gridinsoft": "phishing", "alphaMountain.ai": "suspicious", "Forcepoint ThreatSeeker": "malicious" }, "reputation": 0, "categories": { "alphaMountain.ai": "Suspicious (alphaMountain.ai)" }, "registrar": "Squarespace Domains LLC", "created": "2026-08-03T17:30:28Z", "expires": "2027-08-03T17:30:28Z", "updated": "2026-08-03T17:33:25Z", "first_seen": "2026-08-03T18:01:09Z", "dns": [ { "ttl": 14400, "type": "MX", "value": "crownfacilitys.com", "priority": 0 }, { "ttl": 21600, "type": "SOA", "rname": "allan\\.marques.hagile.com.br", "value": "ns1.serverbrasil.com.br" }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 +a +mx +ip4:192.169.80.42 ~all" }, { "ttl": 21600, "type": "NS", "value": "ns2.serverbrasil.com.br" }, { "ttl": 14400, "type": "A", "value": "192.169.80.42" }, { "ttl": 21600, "type": "NS", "value": "ns1.serverbrasil.com.br" } ], "dns_at": "2026-10-20T13:40:11Z", "jarm": "29d29d15d29d29d00042d42d00000072e74222ce193a6f991becaa3da6c94d", "cert": { "san": [ "*.crownfacilitys.com", "crownfacilitys.com" ], "issuer": "Let's Encrypt / YR1", "serial": "6b7d1d2356bee2fc8b0033f138d77bf6377", "sha256": "e4ae4e0b69db531b522c324baed6b2f65ee5cbc6347382d4c355a259d6936a62", "subject": "*.crownfacilitys.com", "valid_to": "2027-01-01T17:08:18Z", "valid_from": "2026-10-03T17:08:19Z" }, "whois": { "registrar": "Squarespace Domains LLC", "registrar_iana_id": "3827", "registrar_url": "http://squarespace.domains", "created": "2026-08-03T17:30:28Z", "updated": "2026-08-03T17:33:25Z", "expires": "2027-08-03T17:30:28Z", "status": [ "client", "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "ns1.serverbrasil.com.br", "ns2.serverbrasil.com.br" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited", "client delete prohibited" ], "events": { "expiration": "2027-08-03T17:30:28Z", "last changed": "2026-08-03T17:33:25Z", "registration": "2026-08-03T17:30:28Z", "registrar expiration": "2027-08-03T17:30:28Z", "last update of RDAP database": "2026-08-03T17:33:25Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T00:58:17Z", "mail_config": { "mx": [ "crownfacilitys.com" ], "spf": "v=spf1 +a +mx +ip4:192.169.80.42 ~all", "dkim": [ "default" ], "dmarc": true, "dkim_bits": 2048, "spf_lookups": 2 }, "caa_records": { "domain": "crownfacilitys.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-25T00:47:11Z", "first": "2026-10-25T00:47:11Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 9487 }, "social_tags": { "title": "Início — Crown Facility Services", "description": "Crown Facility Services delivers professional commercial cleaning and facility care across Los Angeles. Elevated standards, tailored solutions, and consistent results for professional environments." }, "trackers": { "requests": 0 }, "mixed_content": { "no_sri": [ "https://cdn.tailwindcss.com/" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 161, "tls": 140, "wait": 247, "connect": 123, "download": 35 }, "response_ms": 706 }, "tls_connection": { "alpn": "http/1.1", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 25, 53, 80, 110, 143, 443, 587, 993, 995, 3306, 8888 ] }, "carbon": { "bytes": 35868, "co2_grams": 0.0013, "cleaner_than": 44 }, "dns_server": { "ns": [ { "ip": "216.245.220.189", "host": "ns2.serverbrasil.com.br" }, { "ip": "216.245.220.188", "host": "ns1.serverbrasil.com.br" } ], "zone": "crownfacilitys.com" }, "location": { "ip": "192.169.80.42", "asn": "46475", "org": "Limestone Networks", "city": "Dallas", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "*.crownfacilitys.com" }, "dns": { "A": [ "192.169.80.42" ], "MX": [ "{\"exchange\": \"crownfacilitys.com\", \"priority\": 0}" ], "NS": [ "ns2.serverbrasil.com.br", "ns1.serverbrasil.com.br" ], "SOA": "{\"nsname\": \"ns1.serverbrasil.com.br\", \"hostmaster\": \"allan\\\\.marques.hagile.com.br\", \"serial\": 2026100301, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}", "TXT": [ "v=spf1 +a +mx +ip4:192.169.80.42 ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "192.169.80.42", "family": 4 }, "redirects": { "chain": [ "https://crownfacilitys.com" ] }, "linked_pages": { "internal_count": 13 }, "whois": { "registrar": "Squarespace Domains LLC", "created": "2026-08-03T17:30:28Z", "updated": "2026-08-03T17:33:25Z", "expires": "2027-08-03T17:30:28Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.serverbrasil.com.br", "ns2.serverbrasil.com.br" ] }, "headers": { "headers": { "server": "nginx", "content-type": "text/html; charset=UTF-8", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } } } } ```