# PhishDestroy domain threat record: dash.petrawaves.hu Content language: English Canonical HTML report: https://phishdestroy.io/domain/dash.petrawaves.hu/ Machine-readable companion: https://phishdestroy.io/domain/dash.petrawaves.hu/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-11 03:40:22 UTC - Last availability or vendor check: 2026-10-22 10:20:38 UTC - Stored record updated: 2026-10-22 15:45:01 UTC - VirusTotal detections in the stored snapshot: 6/89 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 194.180.16.234 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Registrar country in stored WHOIS data: Unknown - Registration date in stored WHOIS data: 2024-11-12 23:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a08e8c-989e-770c-bf57-c2d969f297ed/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/dash.petrawaves.hu - Certificate Transparency search: https://crt.sh/?q=%25.dash.petrawaves.hu - Web Archive lookup: https://web.archive.org/web/*/https://dash.petrawaves.hu/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview dash.petrawaves.hu is a credential phishing page that presents a bare sign-in screen titled 'Login' under a 'dash' subdomain, styled to pass as an account dashboard. The wallet-security blocklists that list it (MetaMask and SEAL) point to crypto users as the main audience, though no specific brand is shown on the page. PhishDestroy first detected it on 2026-09-11. As of 2026-10-19 the server still responds, but the phishing content no longer loads. How the scam works The victim reaches the page through a link and sees a plain 'Login' prompt that looks like a routine dashboard sign-in. Whatever goes into the form, typically an email or username, a password and sometimes a one-time code, goes straight to the operators. With those credentials they can take over the real account, change recovery settings, and move funds or data before the owner notices. People who reuse the same password elsewhere are exposed on every service that shares it. Evidence Six of 89 VirusTotal engines flagged the address on 2026-09-24: alphaMountain.ai, Chong Lua Dao, CRDF, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. That is a modest count, so many browsers and security tools may still let the page through without a warning. More weight comes from the blocklists. Besides PhishDestroy, the domain is listed by MetaMask and SEAL, two lists that track threats aimed at crypto wallet users. Infrastructure The parent domain petrawaves.hu was registered on 2024-11-13, almost two years before this subdomain was caught serving a phishing login. A long gap like that means the domain's age offers little protection, because reputation filters tend to trust older domains. The site is hosted in Hungary on Rackforest Zrt. network space, which matches the .hu country code. What to do If you entered credentials on this page, change that password right away, along with the password on any other account where you used it. Then turn on or reset two-factor authentication, preferably with an authenticator app or hardware key. Review active sessions, recent logins, linked devices and withdrawal or recovery settings on the affected account, and contact the service's support if you see changes you did not make. Defenders should block the subdomain and parent domain at DNS and the mail gateway. They should also search logs for earlier visits and force credential resets for any users who submitted data. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a08e8c-989e-770c-bf57-c2d969f297ed/ VirusTotal report: https://www.virustotal.com/gui/domain/dash.petrawaves.hu Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=dash.petrawaves.hu Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:44:33 UTC ## Stored page captures - Primary capture: https://i.ibb.co/8D2t4MXn/cace999e3972.png Captured: 2026-09-11 03:40:22 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a08e8c-989e-770c-bf57-c2d969f297ed.png Captured: 2026-09-11 03:40:22 UTC Source report: https://urlscan.io/result/01a08e8c-989e-770c-bf57-c2d969f297ed/ - URLQuery: https://screenshots.phishdestroy.io/uq/d569e911-cd0c-469a-9762-63700e125965.png Captured: 2026-09-11 03:42:41 UTC Source report: https://urlquery.net/report/d569e911-cd0c-469a-9762-63700e125965 SHA-256: fb1d7d411d19b3894c72de8e482febced9bfb4af71b5ca533136d8adc9178734 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5d8a67e9-ab39-4f1d-b8e0-284a5895ad35.png Captured: 2026-09-11 04:13:31 UTC Source report: https://radar.cloudflare.com/scan/5d8a67e9-ab39-4f1d-b8e0-284a5895ad35 SHA-256: dda8ce7a73a15ba7de1c0aa664c0c24b067b21a7545be0ab7cb8a5aa15192926 - URLScan ยท 2026-09-11: https://screenshots.phishdestroy.io/us/01a08e87-b5b6-7167-ab0b-f38434c2f619.png Captured: 2026-09-11 03:34:21 UTC Source report: https://urlscan.io/result/01a08e87-b5b6-7167-ab0b-f38434c2f619/ SHA-256: a674fa4d386c0d1243c79fb0b2249eed21249dbe9f82cfc335534944aeccfa5d ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T00:19:54Z", "uuid": "01a08e8c-989e-770c-bf57-c2d969f297ed", "scanned_at": "2026-09-11T03:39:41Z", "final_url": "https://dash.petrawaves.hu/login/", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://dash.petrawaves.hu/", "from": "http://dash.petrawaves.hu/", "status": 307 }, { "to": "https://dash.petrawaves.hu/login/", "from": "https://dash.petrawaves.hu/", "status": 302 } ], "ip": "194.180.16.234", "domains": [ "use.fontawesome.com", "ajax.googleapis.com", "stackpath.bootstrapcdn.com" ], "ips": [ "104.21.27.152", "142.251.179.95", "104.18.10.207", "194.180.16.234" ], "asns": [ "13335", "15169", "62214" ], "countries": [ "US", "HU" ], "doc_hash": "d135671cb492187dbf51106efe396a13a77962d47cc52ee8108fdd6d72c82cff", "globals": [ "$", "jQuery" ], "cookies": [ "csrftoken" ], "tls": { "san": [ "dash.petrawaves.hu" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "dash.petrawaves.hu", "protocol": "TLS 1.3", "valid_to": "2026-12-09T02:04:08Z", "valid_from": "2026-09-10T02:04:09Z" }, "domain_age_days": 600, "apex_age_days": 666, "tls_age_days": 1, "tls_valid_days": 89, "requests": 6, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 28, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "openresty", "content-type": "text/html; charset=utf-8", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "same-origin", "cross-origin-opener-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T02:32:24Z", "uuid": "5d8a67e9-ab39-4f1d-b8e0-284a5895ad35", "scanned_at": "2026-09-11T04:13:31Z", "final_url": "https://dash.petrawaves.hu/login/", "status": 200, "redirected": "same-domain", "history": [ { "url": "https://dash.petrawaves.hu/", "status": 302 }, { "url": "https://dash.petrawaves.hu/login/", "status": 200 } ], "dom_hash": "9c0810579739aa751e9420a26452a122f7399fdffbc558e4eb4960a8a1784a73", "doc_hash": "688b3671f180a4cafba883cc23f7db354fa772eb4387fac1f3e7d2e02c33b7e0", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "dash.petrawaves.hu", "type": "A", "value": "194.180.16.234" } ], "dnssec_valid": false, "ip": "194.180.16.234" }, "vt": { "v": 1, "fetched_at": "2026-10-22T16:22:44Z", "analysis_at": "2026-10-11T15:35:34Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 5, "suspicious": 1, "undetected": 33 }, "detections": { "CRDF": "malicious", "SOCRadar": "phishing", "Gridinsoft": "suspicious", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2025-01-18T08:06:13Z", "dns": [ { "ttl": 7200, "type": "A", "value": "194.180.16.234" } ], "dns_at": "2026-10-11T15:52:17Z", "jarm": "27d40d40d00040d00042d43d000000831b6af40378e2dd35eeac4e9311926e", "cert": { "san": [ "dash.petrawaves.hu" ], "issuer": "Let's Encrypt / YE1", "serial": "58f4803a21bd2b670a024cb2fb1ecf16426", "sha256": "9d7475ac059dc88f07fcd4675f88d34d51656ea3c592bca10719ae2462bfdf89", "subject": "dash.petrawaves.hu", "valid_to": "2026-12-09T02:04:08Z", "valid_from": "2026-09-10T02:04:09Z" } } } ```