# PhishDestroy domain threat record: damiluna.ro

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/damiluna.ro/
Machine-readable companion: https://phishdestroy.io/domain/damiluna.ro/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-27 04:26:48 UTC
- Last availability or vendor check: 2026-10-22 10:27:44 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 7/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: MetaMask

## Stored infrastructure

- Observed IP address: 172.67.216.230
- Registrar in stored WHOIS data: Romarg SRL
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2021-08-31 22:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0e11c-a488-71d6-8aea-6932089390cd/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/damiluna.ro
- Certificate Transparency search: https://crt.sh/?q=%25.damiluna.ro
- Web Archive lookup: https://web.archive.org/web/*/https://damiluna.ro/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
damiluna.ro presents itself as "DAMILUNA – Fitofarmacie", a Romanian-language herbal pharmacy storefront, and PhishDestroy classifies it as an impersonation phishing page. The page title shows a phytopharmacy shop, while our classification places the domain among impersonation threats. PhishDestroy first flagged it on 2026-09-27. As of 2026-10-19 the site was still online and serving live content.

How the scam works
Impersonation pages borrow the look and name of a legitimate business so visitors trust them enough to act. Here the lure is the DAMILUNA herbal pharmacy identity. A shopper or wallet user who believes the page is genuine may type in login details, personal or payment information, or connect a crypto wallet. That information goes to the operators rather than to any real business. The victim's losses depend on what they handed over: account access, card data or wallet funds.

Evidence
Seven of 92 VirusTotal engines flagged the domain as of 2026-10-07: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar, VIPRE and Webroot. That is a minority of engines, but the seven are independent vendors that reached the same verdict. Two crypto-focused blocklists, MetaMask and SEAL, list the domain alongside PhishDestroy. MetaMask's listing means wallet users can be warned before the page loads.

Infrastructure
The domain was registered on 2021-09-01 through Romarg SRL, a Romanian registrar. That is roughly five years before PhishDestroy flagged it, so this is an aged domain rather than a freshly registered throwaway, and age alone should not be read as a sign of trust. The site sits behind Cloudflare, with the edge address geolocating to Canada. That setup hides the true origin server from visitors.

What to do
If you entered a password on this site, change it there and on any account that reuses it, and turn on two-factor authentication. If you submitted card details, contact your bank to block the card and dispute unfamiliar charges. If you connected a crypto wallet, review its active token approvals and revoke any you do not recognise, and move funds to a fresh wallet if you approved anything or entered a seed phrase. Defenders should block damiluna.ro at DNS and web proxies. They should also search logs for past visits and report the page to Cloudflare and Romarg SRL for takedown.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0e11c-a488-71d6-8aea-6932089390cd/
VirusTotal report: https://www.virustotal.com/gui/domain/damiluna.ro
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=damiluna.ro
Archived copy: https://web.archive.org/web/20260927042730/https://damiluna.ro/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:57:28 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/KBxY2zH/ced1235abc19.png
  Captured: 2026-09-27 04:26:48 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0e11c-a488-71d6-8aea-6932089390cd.png
  Captured: 2026-09-27 04:26:48 UTC
  Source report: https://urlscan.io/result/01a0e11c-a488-71d6-8aea-6932089390cd/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e022ff24-2bc2-409b-a624-2514d031e452.png
  Captured: 2026-09-27 04:27:34 UTC
  Source report: https://radar.cloudflare.com/scan/e022ff24-2bc2-409b-a624-2514d031e452
  SHA-256: eda982b423f386ae4c71b443bed0f826928e60f14d5d3894a738a1d086b48176
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e11f-d76f-75e6-ba52-b42ef259f850.png
  Captured: 2026-09-27 04:29:21 UTC
  Source report: https://urlscan.io/result/01a0e11f-d76f-75e6-ba52-b42ef259f850/
  SHA-256: 3c7ae8dd7f9be420da3806310f795379b6c9f39a7309e51a6d47ef6c11d85e5a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:56:32Z",
        "uuid": "01a0e11c-a488-71d6-8aea-6932089390cd",
        "scanned_at": "2026-09-27T04:25:52Z",
        "final_url": "https://damiluna.ro/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://damiluna.ro/",
                "from": "http://damiluna.ro/",
                "status": 307
            }
        ],
        "ip": "172.67.216.230",
        "domains": [
            "fonts.gstatic.com",
            "images.unsplash.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.20.94",
            "151.101.194.208",
            "142.251.14.95",
            "172.67.216.230"
        ],
        "asns": [
            "15169",
            "54113",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "21271a87e970b5a4da717c304f2be23264dd73f44b6d0562ebc5e59b481d419a",
        "script_hashes": [
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8"
        ],
        "globals": [
            "requestResize",
            "submitForm",
            "navToggle",
            "navLinks",
            "observer"
        ],
        "tls": {
            "san": [
                "*.damiluna.ro",
                "damiluna.ro"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "damiluna.ro",
            "protocol": "QUIC",
            "valid_to": "2026-12-13T12:18:57Z",
            "valid_from": "2026-09-14T12:18:58Z"
        },
        "domain_age_days": 12,
        "apex_age_days": 12,
        "tls_age_days": 12,
        "tls_valid_days": 89,
        "requests": 11,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 84,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:04:46Z",
        "uuid": "e022ff24-2bc2-409b-a624-2514d031e452",
        "scanned_at": "2026-09-27T04:27:34Z",
        "final_url": "https://damiluna.ro/",
        "status": 200,
        "history": [
            {
                "url": "https://damiluna.ro/",
                "status": 200
            }
        ],
        "dom_hash": "719464130c69d854f5de1dcd7f7c24d1f6b253afbe86ba53e3492fbfbc14f120",
        "doc_hash": "0a8666c2bcf2390ff7f5ad3cb6809586bab27b07032e857f885ae757c7c56f4a",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "damiluna.ro",
                "type": "A",
                "value": "172.67.216.230"
            },
            {
                "name": "damiluna.ro",
                "type": "A",
                "value": "104.21.83.70"
            },
            {
                "name": "damiluna.ro",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:5346"
            },
            {
                "name": "damiluna.ro",
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:d8e6"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.216.230",
        "whois": {
            "registrar": "Romarg SRL",
            "created": "2021-09-01T00:00:00Z",
            "nameservers": [
                "anna.ns.cloudflare.com",
                "sonny.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:46:12Z",
        "analysis_at": "2026-10-17T15:46:06Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 5,
            "suspicious": 1,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "Webroot": "malicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Romarg SRL",
        "first_seen": "2024-07-20T11:41:09Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:d8e6"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "_dc-mx.4b707ee97bd3.damiluna.ro",
                "priority": 0
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "google-site-verification=fU9jvqyZaRdNrqQF69dFwx3D42WnG9vDNQbzolE6pf0"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "anna.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.83.70"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:85.120.16.2 +ip4:85.120.16.3 +include:_include.gazduire.ro ~all"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:5346"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "anna.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "sonny.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.216.230"
            }
        ],
        "dns_at": "2026-10-17T16:47:03Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.damiluna.ro",
                "damiluna.ro"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "600856d701b155d6f6e095c691e70fffce6",
            "sha256": "789cce488fd92693f9ca641dd8c443a97678a2967f570cb13349c1dd2dbe4eb6",
            "subject": "damiluna.ro",
            "valid_to": "2026-12-13T12:18:57Z",
            "valid_from": "2026-09-14T12:18:58Z"
        },
        "whois": {
            "registrar": "Romarg SRL",
            "status": [
                "OK"
            ],
            "dnssec": "Inactive"
        }
    }
}
```