# PhishDestroy domain threat record: danielnegru.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/danielnegru.com/ Machine-readable companion: https://phishdestroy.io/domain/danielnegru.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 04:03:28 UTC - Last availability or vendor check: 2026-10-26 00:19:17 UTC - Stored record updated: 2026-10-26 03:35:29 UTC - VirusTotal detections in the stored snapshot: 4/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: Phishunt - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 138.197.166.118 - Registrar in stored WHOIS data: Squarespace Domains II LLC - Registrar country in stored WHOIS data: CA - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2022-03-16 00:43:24 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1714a-0526-74fa-af2b-8c83641b3c2c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/danielnegru.com - Certificate Transparency search: https://crt.sh/?q=%25.danielnegru.com - Web Archive lookup: https://web.archive.org/web/*/https://danielnegru.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed danielnegru.com as a suspicious domain based on automated security engine detections. The recorded page title was “Daniel Negru – Creative by nature”. The domain was first seen by PhishDestroy on 2026-10-25 and returned HTTP 200 in that capture. How the scam works The current evidence does not show a specific fraud technique, only that the domain was flagged by multiple vendors. Such flagged sites can be used for phishing, credential harvesting, or hosting malicious content, but no malicious forms or wallet interactions were observed on the captured page. Evidence VirusTotal scanned the domain on 2026-10-23 and reported four detections: two malicious (CRDF, DNS8) and two suspicious (SOCRadar, alphaMountain.ai) out of 92 engines. Google Safe Browsing checked on 2026-10-25 and did not flag the site. urlscan captured the page on 2026-10-25, gave an overall clean verdict but its engine flagged the URL as malicious with a score of 97. The external blocklist Phishunt includes the domain, and PhishDestroy’s internal list also marks it. OTX had zero pulses as of 2026-10-25. Infrastructure The domain was registered with Squarespace Domains II LLC on 2022-03-16 and expires on 2027-03-16. DNS was hosted on Google Cloud DNS with DNSSEC enabled. The recorded IP was 138.197.166.118, which belonged to DigitalOcean, LLC in Canada. The recorded TLS certificate was issued by Let’s Encrypt, valid from 2026-09-14 to 2026-12-13. Open ports observed included 22, 53, 80, 443 and 3306. What to do Visitors should avoid entering credentials or downloading files from the site and change any passwords if they may have been entered. Security teams should block the exact domain, review logs for connections to the recorded IP, and monitor for related phishing activity. No wallet-specific remediation is required because no wallet interaction was observed. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a170b0-d0a2-7579-81f4-61a4e95a72b1/ Cloudflare Radar report: https://radar.cloudflare.com/scan/3da6b41e-0c12-48e4-ad9d-ff93aff3ea70 Stored capture screenshot: https://urlscan.io/screenshots/01a170b0-d0a2-7579-81f4-61a4e95a72b1.png Cloudflare Radar screenshot (2026-10-25T04:12:39Z): https://screenshots.phishdestroy.io/cf/3da6b41e-0c12-48e4-ad9d-ff93aff3ea70.png URLScan screenshot (2026-10-13T11:29:21Z): https://screenshots.phishdestroy.io/us/01a13505-f6ab-72cf-999a-746dd1a4d51b.png URLScan capture report: https://urlscan.io/result/01a13505-f6ab-72cf-999a-746dd1a4d51b/ URLScan screenshot (2026-10-16T13:00:55Z): https://screenshots.phishdestroy.io/us/01a144cd-01be-754f-a1e0-7de10e19fb26.png URLScan capture report: https://urlscan.io/result/01a144cd-01be-754f-a1e0-7de10e19fb26/ URLScan screenshot (2026-10-16T14:57:42Z): https://screenshots.phishdestroy.io/us/01a14537-e158-76db-8340-2a749bdd8bdf.png URLScan capture report: https://urlscan.io/result/01a14537-e158-76db-8340-2a749bdd8bdf/ URLScan screenshot (2026-10-19T00:52:12Z): https://screenshots.phishdestroy.io/us/01a151a4-e7cc-7489-9155-2ed40b402451.png URLScan capture report: https://urlscan.io/result/01a151a4-e7cc-7489-9155-2ed40b402451/ URLScan screenshot (2026-10-21T20:31:37Z): https://screenshots.phishdestroy.io/us/01a16029-6f13-7525-9619-63619ae1fdc7.png URLScan capture report: https://urlscan.io/result/01a16029-6f13-7525-9619-63619ae1fdc7/ VirusTotal report: https://www.virustotal.com/gui/domain/danielnegru.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=danielnegru.com Archived copy: https://web.archive.org/web/20261025040616/https://danielnegru.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 04:14:54 UTC ## Stored page captures - Primary capture: https://i.ibb.co/z11Fs1v/4dffeab28eac.png Captured: 2026-10-25 04:21:39 UTC - URLScan capture 1: https://urlscan.io/screenshots/01a1714a-0526-74fa-af2b-8c83641b3c2c.png Captured: 2026-10-25 04:21:39 UTC Source report: https://urlscan.io/result/01a1714a-0526-74fa-af2b-8c83641b3c2c/ - URLScan capture 2: https://screenshots.phishdestroy.io/01a170b0-d0a2-7579-81f4-61a4e95a72b1.png Captured: 2026-10-25 04:03:28 UTC Source report: https://urlscan.io/result/01a1714a-0526-74fa-af2b-8c83641b3c2c/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3da6b41e-0c12-48e4-ad9d-ff93aff3ea70.png Captured: 2026-10-25 04:12:39 UTC Source report: https://radar.cloudflare.com/scan/3da6b41e-0c12-48e4-ad9d-ff93aff3ea70 SHA-256: 757219117d70781aafec96dbb9257a5de20127039c9c7b9ffe33bf0afc834648 - URLQuery: https://screenshots.phishdestroy.io/uq/caf2c846-e4d0-474c-8fc6-1edb5f6bfde1.png Source report: https://urlquery.net/report/caf2c846-e4d0-474c-8fc6-1edb5f6bfde1 SHA-256: d8154bfb7dcec915492640778d2d9c3931918d2eee527bd3d5e4e48ea1c26d94 - URLScan · 2026-10-13: https://screenshots.phishdestroy.io/us/01a13505-f6ab-72cf-999a-746dd1a4d51b.png Captured: 2026-10-13 11:29:21 UTC Source report: https://urlscan.io/result/01a13505-f6ab-72cf-999a-746dd1a4d51b/ SHA-256: ea426c1be1fb9f81cb38d5df9f96a896364e3717be6917dd8069b3d8d06dd48c - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a144cd-01be-754f-a1e0-7de10e19fb26.png Captured: 2026-10-16 13:00:55 UTC Source report: https://urlscan.io/result/01a144cd-01be-754f-a1e0-7de10e19fb26/ SHA-256: e85ba84e4b0193a28e5bba60c9f5f681f68f95fd16318112297aeeadbf2ccc57 - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a146e4-e7d1-743a-a2e9-0f8d07f2bbd6.png Captured: 2026-10-16 22:46:15 UTC Source report: https://urlscan.io/result/01a146e4-e7d1-743a-a2e9-0f8d07f2bbd6/ SHA-256: e85ba84e4b0193a28e5bba60c9f5f681f68f95fd16318112297aeeadbf2ccc57 - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a151a4-e7cc-7489-9155-2ed40b402451.png Captured: 2026-10-19 00:52:12 UTC Source report: https://urlscan.io/result/01a151a4-e7cc-7489-9155-2ed40b402451/ SHA-256: e85ba84e4b0193a28e5bba60c9f5f681f68f95fd16318112297aeeadbf2ccc57 - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a16029-6f13-7525-9619-63619ae1fdc7.png Captured: 2026-10-21 20:31:37 UTC Source report: https://urlscan.io/result/01a16029-6f13-7525-9619-63619ae1fdc7/ SHA-256: e85ba84e4b0193a28e5bba60c9f5f681f68f95fd16318112297aeeadbf2ccc57 - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17157-a14f-73fd-98c3-9a892843b61d.png Captured: 2026-10-25 04:35:45 UTC Source report: https://urlscan.io/result/01a17157-a14f-73fd-98c3-9a892843b61d/ SHA-256: a36eb902425fec371e15426d11035935efc833be80fb29e08fa6603cf67389b9 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T04:36:49Z", "uuid": "01a1714a-0526-74fa-af2b-8c83641b3c2c", "scanned_at": "2026-10-25T04:20:48Z", "final_url": "https://danielnegru.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://danielnegru.com/", "from": "http://danielnegru.com/", "status": 307 } ], "ip": "138.197.166.118", "ptr": "horus.arcanefour.com", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "192.178.183.94", "142.251.127.95", "138.197.166.118" ], "asns": [ "15169", "14061" ], "countries": [ "US", "CA" ], "link_domains": [ "ap.udec.cl", "backlinkhacklink.com", "backlinkpaketlerisatinal.com", "calidad.udec.cl", "dacc.udec.cl", "e-marubouro.com", "editorial.udec.cl", "eniyihacklink.com", "gearbox.udec.cl", "geografia.udec.cl", "gobiernoabierto.udec.cl", "guncelhacklink.com", "guvenilirhacklink.com", "hacklink.blog", "hacklinkajansi.com", "hacklinkbal.com", "hacklinkcakar.com", "hacklinkforumu.com", "hacklinkgirisyap.com", "hacklinkjackson.com", "hacklinkmagazasi.com", "hacklinkmarket.com", "hacklinkmarketing.com", "hacklinkmerkezi.com", "hacklinkmichael.com", "hacklinknedur.com", "hacklinknetworku.com", "hacklinknoid.com", "hacklinkoku.com", "hacklinkpaketleri.com" ], "social": [ "https://t.me/hacklink_panel", "https://www.facebook.com/hacklink.official", "https://www.youtube.com/@hacklinksatinal", "https://x.com/hacklinkpanel" ], "doc_hash": "15bfe23845ce3f855207a09cc63bf8db1373c8c7b7a87d9acf6547ef63242408", "script_hashes": [ "5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782", "cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981", "029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300", "d7eff2d3185c4035edbe18b653f9da26c2d872e03c92419542ed524d569fe81b", "f1d5583d4c00ebe19c7be536e72ab8234c1f926023cb5a1fd5edbe9c912f0f49", "e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789", "449ad5dda77ea5602e212b043997b073174bdd8b1cef20c688ea2438b7cf0379", "95badc661d97c4955985e1725c4a6b69d8f748d8d4766b4e4cc552bd5661c19b", "9dfe3e80a1c5c4d69bc58b8263acd2c5ceabf8bee0ad52bfcca0d0d504e66af8", "299f96ab28a67759514494bf886a7b2174fb36cbfa434bf68a732f82729c62a0" ], "globals": [ "_wpemojiSettings", "twemoji", "wp", "jQuery", "swv", "wpcf7", "addComment", "html5", "Modernizr", "yepnope", "eventie", "docReady", "EventEmitter", "getStyleProperty", "getSize", "matchesSelector", "Outlayer", "Isotope", "Masonry", "classie", "Packery", "FitThumbScreen", "_gsScope", "_gsQueue", "GreenSockGlobals", "com", "_gsDefine", "Ease", "Power4", "Strong", "Quint", "Power3", "Quart", "Power2", "Cubic", "Power1", "Quad", "Power0", "Linear", "TweenLite" ], "storage_keys": [ "modernizr" ], "tls": { "san": [ "danielnegru.com", "www.danielnegru.com" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "www.danielnegru.com", "protocol": "TLS 1.3", "valid_to": "2026-12-13T04:08:44Z", "valid_from": "2026-09-14T04:08:45Z" }, "domain_age_days": 1684, "apex_age_days": 1684, "tls_age_days": 41, "tls_valid_days": 89, "requests": 53, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 87, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T04:14:07Z", "uuid": "3da6b41e-0c12-48e4-ad9d-ff93aff3ea70", "scanned_at": "2026-10-25T04:12:39Z", "final_url": "https://danielnegru.com/", "status": 200, "history": [ { "url": "https://danielnegru.com/", "status": 200 } ], "dom_hash": "afa3186d7f78dcca2b6b0fe56fbd4e75852737b93bbc52002b3f30d5e6025dcb", "doc_hash": "15bfe23845ce3f855207a09cc63bf8db1373c8c7b7a87d9acf6547ef63242408", "domain_risks": [ "Information Technology", "Technology", "Personal Blogs", "Internet Communication", "Hobbies & Interests", "Society & Lifestyle" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "danielnegru.com", "type": "A", "value": "138.197.166.118" } ], "dnssec_valid": true, "ip": "138.197.166.118", "whois": { "registrar": "Squarespace Domains II LLC", "created": "2022-03-16T01:43:24Z", "updated": "2026-03-01T02:43:07Z", "expires": "2027-03-16T01:43:24Z", "nameservers": [ "ns-cloud-c1.googledomains.com", "ns-cloud-c2.googledomains.com", "ns-cloud-c3.googledomains.com", "ns-cloud-c4.googledomains.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T04:11:44Z", "analysis_at": "2026-10-23T09:51:01Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 2, "suspicious": 2, "undetected": 34 }, "detections": { "CRDF": "malicious", "DNS8": "phishing", "SOCRadar": "suspicious", "alphaMountain.ai": "suspicious" }, "reputation": 0, "registrar": "Squarespace Domains II LLC", "created": "2022-03-16T01:43:24Z", "expires": "2027-03-16T01:43:24Z", "updated": "2026-03-01T02:43:07Z", "first_seen": "2024-03-04T15:15:21Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "ns-cloud-c4.googledomains.com" }, { "ttl": 21600, "type": "NS", "value": "ns-cloud-c1.googledomains.com" }, { "ttl": 21600, "type": "NS", "value": "ns-cloud-c3.googledomains.com" }, { "ttl": 21600, "type": "SOA", "rname": "cloud-dns-hostmaster.google.com", "value": "ns-cloud-c1.googledomains.com" }, { "ttl": 14400, "type": "A", "value": "138.197.166.118" }, { "ttl": 21600, "type": "NS", "value": "ns-cloud-c2.googledomains.com" } ], "dns_at": "2026-10-23T09:51:19Z", "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b", "cert": { "san": [ "danielnegru.com", "www.danielnegru.com" ], "issuer": "Let's Encrypt / YR2", "serial": "590f593bca130dc80112dbc7fb393fbe64d", "sha256": "79f0ce54e50be49586c32db55b252827642f37e16b8d048d5342b6347079bca0", "subject": "www.danielnegru.com", "valid_to": "2026-12-13T04:08:44Z", "valid_from": "2026-09-14T04:08:45Z" }, "whois": { "registrar": "Squarespace Domains II LLC", "registrar_iana_id": "895", "registrar_url": "http://domains2.squarespace.com", "created": "2022-03-16T01:43:24Z", "updated": "2026-03-01T02:43:07Z", "expires": "2027-03-16T01:43:24Z", "status": [ "client", "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "ns-cloud-c1.googledomains.com", "ns-cloud-c2.googledomains.com", "ns-cloud-c3.googledomains.com", "ns-cloud-c4.googledomains.com" ], "dnssec": "signedDelegation" }, "rdap": { "status": [ "client transfer prohibited", "client delete prohibited" ], "events": { "expiration": "2027-03-16T01:43:24Z", "last changed": "2026-03-01T02:43:07Z", "registration": "2022-03-16T01:43:24Z", "registrar expiration": "2027-03-16T01:43:24Z", "last update of RDAP database": "2026-03-01T02:43:07Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T04:14:29Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "danielnegru.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-25T04:06:16Z", "first": "2024-09-12T16:07:42Z", "changes": 7, "days_archived": 14, "scans_per_day": 0.02, "avg_page_bytes": 8447 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://danielnegru.com/wp-sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 59 }, "social_tags": { "title": "Daniel Negru – Creative by nature", "robots": "max-image-preview:large", "generator": "WordPress 6.1.15", "canonicalUrl": "https://danielnegru.com/" }, "trackers": { "requests": 52, "trackers": [ { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 5 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 55, "tls": 447, "wait": 948, "connect": 112, "download": 887 }, "response_ms": 2449 }, "tls_connection": { "alpn": "http/1.1", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 22, 53, 80, 443, 3306 ] }, "carbon": { "bytes": 116630, "co2_grams": 0.0043, "cleaner_than": 19 }, "dns_server": { "ns": [ { "ip": "216.239.36.108", "host": "ns-cloud-c3.googledomains.com" }, { "ip": "216.239.34.108", "host": "ns-cloud-c2.googledomains.com" }, { "ip": "216.239.38.108", "host": "ns-cloud-c4.googledomains.com" }, { "ip": "216.239.32.108", "host": "ns-cloud-c1.googledomains.com" } ], "zone": "danielnegru.com" }, "location": { "ip": "138.197.166.118", "asn": "14061", "org": "DigitalOcean, LLC", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YR2", "subject": "www.danielnegru.com" }, "dns": { "A": [ "138.197.166.118" ], "NS": [ "ns-cloud-c2.googledomains.com", "ns-cloud-c4.googledomains.com", "ns-cloud-c1.googledomains.com", "ns-cloud-c3.googledomains.com" ], "SOA": "{\"nsname\": \"ns-cloud-c1.googledomains.com\", \"hostmaster\": \"cloud-dns-hostmaster.google.com\", \"serial\": 6, \"refresh\": 21600, \"retry\": 3600, \"expire\": 259200, \"minttl\": 300}" }, "dnssec": { "ds": true, "rrsig": true, "dnskey": true }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "138.197.166.118", "family": 4 }, "redirects": { "chain": [ "https://danielnegru.com" ] }, "linked_pages": { "external": [ "https://hacklinkmarket.com/", "https://www.buyhacklinks.com/", "https://www.hacklink.com.tr/", "https://www.youtube.com/@hacklinksatinal", "https://hacklinkali.com/", "https://osibana.jp/", "https://marsbahisdemo.com/marsli/", "https://ap.udec.cl/", "https://backlinkhacklink.com/", "https://backlinkpaketlerisatinal.com/", "https://calidad.udec.cl/", "https://dacc.udec.cl/", "https://e-marubouro.com/", "https://editorial.udec.cl/", "https://eniyihacklink.com/", "https://gearbox.udec.cl/", "https://geografia.udec.cl/", "https://gobiernoabierto.udec.cl/", "https://guncelhacklink.com/", "https://guvenilirhacklink.com/", "https://hacklink.blog/", "https://hacklinkajansi.com/", "https://hacklinkbal.com/", "https://hacklinkcakar.com/", "https://hacklinkforumu.com/" ], "external_count": 144, "internal_count": 13 }, "whois": { "registrar": "Squarespace Domains II LLC", "created": "2022-03-16T01:43:24Z", "updated": "2026-03-01T02:43:07Z", "expires": "2027-03-16T01:43:24Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns-cloud-c1.googledomains.com", "ns-cloud-c2.googledomains.com", "ns-cloud-c3.googledomains.com", "ns-cloud-c4.googledomains.com" ] }, "headers": { "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8" } } } } ```