# crushxp.com — Recorded security evidence | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/crushxp.com/ Machine-readable companion: https://phishdestroy.io/domain/crushxp.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 01:20:10 UTC - Last availability or vendor check: 2026-11-01 03:38:14 UTC - Stored record updated: 2026-11-01 07:21:27 UTC - VirusTotal detections in the stored snapshot: 12/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored infrastructure - Observed IP address: 109.238.86.5 - Registrar in stored WHOIS data: NAMECHEAP INC - Registrar country in stored WHOIS data: US - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2023-02-15 18:08:50 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a170a4-0612-70ea-aa36-418805ed964f/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/crushxp.com - Certificate Transparency search: https://crt.sh/?q=%25.crushxp.com - Web Archive lookup: https://web.archive.org/web/*/https://crushxp.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy stores a record for crushxp.com. Source observations are dated separately; missing checks do not establish safety. PhishDestroy stores a record for crushxp.com. Source observations are dated separately; missing checks do not establish safety. A reviewed analysis is not available for this text revision. Consult the dated source records below. Package revision: 768434bde66d621e7a6871be9101dde758db728313997cd20b0b8d0beecbbf86 Source facts (timestamps as stored): {"record_id":1653875,"first_recorded_at":"2026-10-25 02:20:10","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":12,"denominator":92,"malicious":9,"suspicious":3,"vendors":{"DNS8":"suspicious","ESET":"suspicious","VIPRE":"malware","Lionic":"phishing","Sophos":"phishing","Webroot":"malicious","Fortinet":"phishing","SOCRadar":"phishing","Kaspersky":"phishing","Gridinsoft":"suspicious","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"observed_at":"2026-10-19T05:50:08Z","checked_at":"2026-10-25 03:28:40","fetched_at":"2026-10-25T02:28:38Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":12,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","DNS8","ESET","Forcepoint ThreatSeeker","Fortinet","Gridinsoft","Kaspersky","Lionic","SOCRadar","Sophos","VIPRE","Webroot"],"observed_at":"2026-10-19 05:50:08","checked_at":"2026-10-25 03:28:40","fetched_at":"2026-10-25 02:28:41","time_basis":"as stored; legacy timezone not established"}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-10-31 06:01:00"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-10-25 04:30:57"},"availability":{"source":"stored HTTP observation","state":"alive","observed_at":"2026-11-01 04:38:14"}} ## Stored page captures - Primary capture: https://i.ibb.co/sdBt207w/cd530683bfad.png Captured: 2026-10-25 01:20:10 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a170a4-0612-70ea-aa36-418805ed964f.png Captured: 2026-10-25 01:20:10 UTC Source report: https://urlscan.io/result/01a170a4-0612-70ea-aa36-418805ed964f/ - URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0c064-35b7-7435-94bd-9aa2e4d9e6d3.png Captured: 2026-09-20 19:56:34 UTC Source report: https://urlscan.io/result/01a0c064-35b7-7435-94bd-9aa2e4d9e6d3/ SHA-256: 31c4d5d2c0aa722c7e32f414d816aaabc5d5051eafe7aa834e181e22a5a25bf5 - URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a139a7-ad76-7304-bc1b-cbaf4d4c0cee.png Captured: 2026-10-14 09:04:19 UTC Source report: https://urlscan.io/result/01a139a7-ad76-7304-bc1b-cbaf4d4c0cee/ SHA-256: 7dea5eb049fd634ff9ef70d33a31c94ce2ef5a401bb577d48a0dd41f6aec4061 - URLScan · 2026-10-15: https://screenshots.phishdestroy.io/us/01a13f08-2bbf-72af-8562-2e393a3a2415.png Captured: 2026-10-15 10:08:03 UTC Source report: https://urlscan.io/result/01a13f08-2bbf-72af-8562-2e393a3a2415/ SHA-256: 94ed8dc56422b047ad4898fe3c5beb4309173dc2187b3beec0b3c0183e332f09 - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a1709f-d569-7089-8eb5-5e644d78cf9c.png Captured: 2026-10-25 01:14:51 UTC Source report: https://urlscan.io/result/01a1709f-d569-7089-8eb5-5e644d78cf9c/ SHA-256: 697049fb75c6e75d75b01cf44ebe6f377c1551fd7c5deb0031e0c5a233e9b41a - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/689972cc-0d8a-452a-8798-b2ab26012a11.png Captured: 2026-10-25 01:23:25 UTC Source report: https://radar.cloudflare.com/scan/689972cc-0d8a-452a-8798-b2ab26012a11 SHA-256: 96b8c9c9f4d3d2e1cad91c9d211904665fd84d192a816674bcb8c47d2c5bd506 - URLQuery: https://screenshots.phishdestroy.io/uq/10ce5058-808b-47c6-b571-2f6df9d770b1.png Source report: https://urlquery.net/report/10ce5058-808b-47c6-b571-2f6df9d770b1 SHA-256: b952759a7176bf1ff1fd7ee430c7b70fade49b6cfb67bd8b90b069290467ce2e ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T01:23:35Z", "uuid": "01a170a4-0612-70ea-aa36-418805ed964f", "scanned_at": "2026-10-25T01:19:27Z", "final_url": "https://crushxp.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://crushxp.com/", "from": "http://crushxp.com/", "status": 307 } ], "ip": "109.238.86.5", "ips": [ "109.238.86.5" ], "asns": [ "201738" ], "countries": [ "GB" ], "doc_hash": "31ad9c5aca14619bf35d700168669f402d18d2cc3d69f1bd554fa0491673d88a", "globals": [ "elapsedMS", "telemetryPayload", "logTelemetry", "setStatus", "setBusy", "formatISODate", "makeChoice", "markChoice", "selectDate", "selectTime", "buildSchedulePickers", "resetSchedulePickers", "fieldHasValue", "refreshCompletedFields", "sha256Hex", "base64JSON", "solveAltchaChallenge", "createAltchaPayload", "form", "lang", "messages", "button", "statusNode", "dateInput", "timeInput", "dateOptions", "timeOptions", "endpoints", "safePageClassNames", "flowID", "pageID", "startedAt", "requiredFieldNames", "timeSlots", "completedFields", "formStartedLogged", "formReadyLogged" ], "tls": { "san": [ "crushxp.com" ], "cipher": "CHACHA20_POLY1305", "issuer": "YE2", "subject": "crushxp.com", "protocol": "TLS 1.3", "valid_to": "2026-12-19T18:56:47Z", "valid_from": "2026-09-20T18:56:48Z" }, "domain_age_days": 3430, "apex_age_days": 3430, "tls_age_days": 34, "tls_valid_days": 89, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -10, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html; charset=utf-8", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T01:58:34Z", "uuid": "689972cc-0d8a-452a-8798-b2ab26012a11", "scanned_at": "2026-10-25T01:23:25Z", "final_url": "https://crushxp.com/", "status": 200, "history": [ { "url": "https://crushxp.com/", "status": 200 } ], "dom_hash": "4e7239983318f7def7f593bdb449bd66d62e740846499af37c18aceaaf84f86d", "doc_hash": "a999440c33bbe619a28538b45f7ca5198b50d2273c69c79ffac57cdcbb2c5008", "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "crushxp.com", "type": "A", "value": "109.238.86.5" } ], "dnssec_valid": false, "ip": "109.238.86.5", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "NameCheap, Inc.", "created": "2023-02-15T19:08:50Z", "updated": "2026-01-16T06:45:29Z", "expires": "2027-02-15T19:08:50Z", "nameservers": [ "ns1.stackdns.com", "ns2.stackdns.com", "ns3.stackdns.com", "ns4.stackdns.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T02:28:38Z", "analysis_at": "2026-10-19T05:50:08Z", "stats": { "timeout": 0, "harmless": 49, "malicious": 9, "suspicious": 3, "undetected": 31 }, "detections": { "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "malware", "Lionic": "phishing", "Sophos": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Gridinsoft": "suspicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "NAMECHEAP INC", "created": "2023-02-15T19:08:50Z", "expires": "2027-02-15T19:08:50Z", "updated": "2026-01-16T06:45:29Z", "first_seen": "2024-03-04T19:18:20Z", "dns": [ { "ttl": 3600, "type": "TXT", "value": "v=spf1 include:spf.stackmail.com a mx -all" }, { "ttl": 3600, "type": "NS", "value": "ns3.stackdns.com" }, { "ttl": 3600, "type": "A", "value": "109.238.86.5" }, { "ttl": 3600, "type": "SOA", "rname": "hostmaster.stackdns.com", "value": "ns1.stackdns.com" }, { "ttl": 3600, "type": "NS", "value": "ns1.stackdns.com" }, { "ttl": 3600, "type": "NS", "value": "ns4.stackdns.com" }, { "ttl": 3600, "type": "NS", "value": "ns2.stackdns.com" } ], "dns_at": "2026-10-19T05:55:24Z", "jarm": "40d40d40d00000000043d43d00043dabadbb43f9614a00c843a4ecd074ab81", "cert": { "san": [ "crushxp.com" ], "issuer": "Let's Encrypt / YE2", "serial": "66f41a19e7ba68772305308c2f59e6cf9a", "sha256": "e9ef9db8a3ab74d85fc9d9aa598317d5f1bb6e4d69c53348b10023b0368e869d", "subject": "crushxp.com", "valid_to": "2026-12-19T18:56:47Z", "valid_from": "2026-09-20T18:56:48Z" }, "whois": { "registrar": "NAMECHEAP INC", "registrar_iana_id": "1068", "registrar_url": "http://www.namecheap.com", "created": "2023-02-15T19:08:50Z", "updated": "2026-01-16T06:45:29Z", "expires": "2027-02-15T19:08:50Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1.stackdns.com", "ns2.stackdns.com", "ns3.stackdns.com", "ns4.stackdns.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "last changed": "2026-01-16T06:45:29Z", "registration": "2023-02-15T19:08:50Z", "registrar expiration": "2027-02-15T19:08:50Z", "last update of RDAP database": "2026-10-16T04:37:45Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T01:23:58Z", "mail_config": { "spf": "v=spf1 include:spf.stackmail.com a mx -all", "spf_lookups": 3 }, "caa_records": { "domain": "crushxp.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-25T01:23:33Z", "first": "2017-06-19T11:20:02Z", "changes": 21, "days_archived": 25, "scans_per_day": 0.01, "avg_page_bytes": 6742 }, "robots_txt": { "agents": [ "*" ], "present": true }, "social_tags": { "ogUrl": "https://crushxp.com/", "title": "Private Budget Review", "ogType": "website", "robots": "index,follow", "ogImage": "https://crushxp.com/static/pattern.svg", "ogTitle": "Private Budget Review", "ogSiteName": "Planning Desk", "twitterCard": "summary_large_image", "canonicalUrl": "https://crushxp.com/", "ogDescription": "Start a simple financial support request with protected online access." }, "trackers": { "requests": 2 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 95, "wait": 74, "connect": 25, "download": 14 }, "response_ms": 210 }, "tls_connection": { "alpn": "http/1.1", "cipher": "TLS_CHACHA20_POLY1305_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 22, 80, 443 ] }, "carbon": { "bytes": 34647, "co2_grams": 0.0013, "cleaner_than": 45 }, "dns_server": { "ns": [ { "ip": "35.197.225.59", "host": "ns1.stackdns.com" }, { "ip": "35.198.79.191", "host": "ns3.stackdns.com" }, { "ip": "104.196.137.209", "host": "ns4.stackdns.com" }, { "ip": "146.148.28.88", "host": "ns2.stackdns.com" } ], "zone": "crushxp.com" }, "location": { "ip": "109.238.86.5", "asn": "201738", "org": "UFO TECHNOLOGIES LIMITED", "city": "Erith", "country": "GB" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "crushxp.com" }, "dns": { "A": [ "109.238.86.5" ], "NS": [ "ns1.stackdns.com", "ns3.stackdns.com", "ns4.stackdns.com", "ns2.stackdns.com" ], "SOA": "{\"nsname\": \"ns1.stackdns.com\", \"hostmaster\": \"hostmaster.stackdns.com\", \"serial\": 1789933537, \"refresh\": 1800, \"retry\": 900, \"expire\": 1209600, \"minttl\": 300}", "TXT": [ "v=spf1 include:spf.stackmail.com a mx -all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": "1; mode=block", "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "109.238.86.5", "family": 4 }, "redirects": { "chain": [ "https://crushxp.com" ] }, "subdomains": { "count": 97, "subdomains": [ "2slcrwvbs22g931l.crushxp.com", "a.crushxp.com", "abra.crushxp.com", "account.crushxp.com", "admin1.crushxp.com", "admin2.crushxp.com", "api.crushxp.com", "api2.crushxp.com", "apps.crushxp.com", "auth0.crushxp.com", "backend.crushxp.com", "backoffice.crushxp.com", "builder.crushxp.com", "callback.crushxp.com", "canary.crushxp.com", "cd.crushxp.com", "cms.crushxp.com", "container.crushxp.com", "cpanel.crushxp.com", "cpcalendars.crushxp.com", "cpcontacts.crushxp.com", "crm-verify.crushxp.com", "ctrl.crushxp.com", "customer.crushxp.com", "debug.crushxp.com", "demo.crushxp.com", "dev.crushxp.com", "dev2.crushxp.com", "docker.crushxp.com", "f1voakj3h2aqpblr.crushxp.com", "federation.crushxp.com", "global-login.crushxp.com", "gradio.crushxp.com", "h.crushxp.com", "hml.crushxp.com", "hr.crushxp.com", "infrastructure.crushxp.com", "jmouwg4e0udj8fal.crushxp.com", "jor.crushxp.com", "k8s.crushxp.com", "kibana.crushxp.com", "langflow.crushxp.com", "loadbalancer.crushxp.com", "localhost.crushxp.com", "m.crushxp.com", "mail.crushxp.com", "manage.crushxp.com", "master.crushxp.com", "media.crushxp.com", "member.crushxp.com" ] }, "whois": { "registrar": "NameCheap, Inc.", "created": "2023-02-15T19:08:50Z", "updated": "2026-01-16T06:45:29Z", "expires": "2027-02-15T19:08:50Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.stackdns.com", "ns2.stackdns.com", "ns3.stackdns.com", "ns4.stackdns.com" ] }, "headers": { "headers": { "server": "nginx", "content-type": "text/html; charset=utf-8", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } } } } ```