# PhishDestroy domain threat record: device-tracker.us

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/device-tracker.us/
Machine-readable companion: https://phishdestroy.io/domain/device-tracker.us/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 06:20:28 UTC
- Last availability or vendor check: 2026-10-25 06:34:55 UTC
- Stored record updated: 2026-10-25 08:11:55 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 103.224.212.142
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2025-10-08 15:17:35 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a171c3-3dbd-713f-85b6-6721af455588/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/device-tracker.us
- Certificate Transparency search: https://crt.sh/?q=%25.device-tracker.us
- Web Archive lookup: https://web.archive.org/web/*/https://device-tracker.us/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed device-tracker.us on 2026-10-25 after an intake rule flagged the domain because VirusTotal reported one malicious detection. The page observed at intake contained only the privacy-related statement "Do Not Sell or Share My Personal Information" and no clear service offering. An HTTP 200 response was recorded on the same date, confirming the site was reachable at that time.

How the scam works
The current evidence does not demonstrate a specific fraud technique; the domain is simply classified as suspicious based on external detections. A phishing label from a security vendor suggests the site could be used to trick users into disclosing personal data, but no credential-collection form or malicious payload was observed. In general, domains with such classifications may be employed for deceptive content or as placeholders for future campaigns.

Evidence
VirusTotal analysis on 2026-10-20 found one malicious detection out of 92 engines, with Gridinsoft labeling the domain as phishing; the result was retrieved on 2026-10-25. Google Safe Browsing reported no threat as of 2026-10-25. Spamhaus DBL listed the domain as phishing on 2026-10-25. OTX recorded three pulses mentioning the domain on the same date. PhishDestroy’s internal blocklist marked the domain as malicious on 2026-10-25, while external blocklists showed no entries. URLScan captured the site on 2026-10-25, reporting an overall clean verdict but its engine flagged it as malicious with a score of 6.

Infrastructure
The domain was registered on 2025-10-08 through Dynadot Inc and was 381 days old at the time of observation. The recorded IP was 103.224.212.142, which the scan identified as belonging to Trellian Pty. Limited in Australia. The site used a Let's Encrypt / YE1 TLS certificate that was valid from 2026-10-10 to 2027-01-08, with a SAN list containing many unrelated domains. Nameservers recorded at the time were ns1.abovedomains.com and ns2.abovedomains.com, and the MX record pointed to park-mx.above.com.

What to do
Visitors should avoid entering any personal or login information on the site. Organizations should add device-tracker.us to their blocklists and monitor DNS logs for queries to 103.224.212.142. If any credentials were submitted elsewhere via this domain, reset them promptly and enable multi-factor authentication where possible.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a171c3-3dbd-713f-85b6-6721af455588/
Cloudflare Radar report: https://radar.cloudflare.com/scan/53b619fd-2ab6-4e11-bfbb-5a3e4e1ee6f5
URLQuery report: https://urlquery.net/report/45770e18-601e-40c9-8cc3-01676775f4aa
Stored capture screenshot: https://i.ibb.co/r2V79B0K/6e64ba145edc.png
Cloudflare Radar screenshot (2026-10-25T06:23:34Z): https://screenshots.phishdestroy.io/cf/53b619fd-2ab6-4e11-bfbb-5a3e4e1ee6f5.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/45770e18-601e-40c9-8cc3-01676775f4aa.png
URLScan screenshot (2026-07-27T12:45:43Z): https://screenshots.phishdestroy.io/us/019fa39b-f1ab-77f8-bae4-e36783ec865b.png
URLScan capture report: https://urlscan.io/result/019fa39b-f1ab-77f8-bae4-e36783ec865b/
URLScan screenshot (2026-10-25T06:45:44Z): https://screenshots.phishdestroy.io/us/01a171ce-a4d7-70ed-8ac7-c6858d131b64.png
URLScan capture report: https://urlscan.io/result/01a171ce-a4d7-70ed-8ac7-c6858d131b64/
VirusTotal report: https://www.virustotal.com/gui/domain/device-tracker.us
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=device-tracker.us
Archived copy: https://web.archive.org/web/20261025062214/https://device-tracker.us/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 07:35:29 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/r2V79B0K/6e64ba145edc.png
  Captured: 2026-10-25 06:34:55 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a171c3-3dbd-713f-85b6-6721af455588.png
  Captured: 2026-10-25 06:34:55 UTC
  Source report: https://urlscan.io/result/01a171c3-3dbd-713f-85b6-6721af455588/
- URLScan capture 2: https://screenshots.phishdestroy.io/019fa39b-f1ab-77f8-bae4-e36783ec865b.png
  Captured: 2026-10-25 06:20:28 UTC
  Source report: https://urlscan.io/result/01a171c3-3dbd-713f-85b6-6721af455588/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/53b619fd-2ab6-4e11-bfbb-5a3e4e1ee6f5.png
  Captured: 2026-10-25 06:23:34 UTC
  Source report: https://radar.cloudflare.com/scan/53b619fd-2ab6-4e11-bfbb-5a3e4e1ee6f5
  SHA-256: e2106e4b6b828f9618eea08c508191ec904d3a9dc935777332d4206abff5b095
- URLQuery: https://screenshots.phishdestroy.io/uq/45770e18-601e-40c9-8cc3-01676775f4aa.png
  Source report: https://urlquery.net/report/45770e18-601e-40c9-8cc3-01676775f4aa
  SHA-256: a8a193292a4f734ef1edc56ce22162a28939d40bba5f4fa3744879a2f0f03e0f
- URLScan · 2026-07-27: https://screenshots.phishdestroy.io/us/019fa39b-f1ab-77f8-bae4-e36783ec865b.png
  Captured: 2026-07-27 12:45:43 UTC
  Source report: https://urlscan.io/result/019fa39b-f1ab-77f8-bae4-e36783ec865b/
  SHA-256: 216bad6558c0b981fcbf0740917f4f395665f5cfe294e583aee9843f665e0198
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a171ce-a4d7-70ed-8ac7-c6858d131b64.png
  Captured: 2026-10-25 06:45:44 UTC
  Source report: https://urlscan.io/result/01a171ce-a4d7-70ed-8ac7-c6858d131b64/
  SHA-256: 5de4ec8c7fbf9ae8f0608588d435adf6cdb55539c42501496f35404e0fc96995

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T06:53:41Z",
        "uuid": "01a171c3-3dbd-713f-85b6-6721af455588",
        "scanned_at": "2026-10-25T06:33:13Z",
        "final_url": "https://device-tracker.us/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://device-tracker.us/",
                "from": "http://device-tracker.us/",
                "status": 307
            }
        ],
        "ip": "103.224.212.142",
        "ptr": "lb-212-142.above.com",
        "domains": [
            "assets.abovedomains.com"
        ],
        "ips": [
            "152.233.50.1",
            "103.224.212.142"
        ],
        "asns": [
            "212238",
            "133618"
        ],
        "countries": [
            "US",
            "AU"
        ],
        "link_domains": [
            "www.dynadot.com"
        ],
        "doc_hash": "3e634c2b706917599357806e559f36e9bef775df1b5bab2cc6dffcef23a7ffe5",
        "tls": {
            "san": [
                "*.4526.de",
                "*.88932.my",
                "*.ape-xmedia247.digital",
                "*.aurnelis.com",
                "*.bankroll.icu",
                "*.bjblc.com.cn",
                "*.cashcowbountyboard.com",
                "*.chegouminhacompra.sbs",
                "*.coloradomarriage.com",
                "*.desiremovies.it.com"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YE1",
            "subject": "w3t61ecd.top",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-08T04:32:12Z",
            "valid_from": "2026-10-10T04:32:13Z"
        },
        "domain_age_days": 381,
        "apex_age_days": 381,
        "tls_age_days": 15,
        "tls_valid_days": 89,
        "requests": 3,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 6,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T06:25:52Z",
        "uuid": "53b619fd-2ab6-4e11-bfbb-5a3e4e1ee6f5",
        "scanned_at": "2026-10-25T06:23:34Z",
        "final_url": "https://device-tracker.us/",
        "status": 200,
        "history": [
            {
                "url": "https://device-tracker.us/",
                "status": 200
            }
        ],
        "dom_hash": "085cca59fd99ee20e094c05311218a5dd9a090923373534694e6a4b6dbb2e3d4",
        "doc_hash": "d1edd61777c51bd598eaa14a09dbc2b663c770837d9f68298665c41682a2aa52",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "device-tracker.us",
                "type": "A",
                "value": "103.224.212.142"
            }
        ],
        "dnssec_valid": false,
        "ip": "103.224.212.142",
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2025-10-08T17:17:35Z",
            "updated": "2026-10-09T20:17:55Z",
            "expires": "2026-10-08T17:17:35Z",
            "nameservers": [
                "5014.ns2.abovedomains.com",
                "5014.ns1.abovedomains.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T07:32:58Z",
        "analysis_at": "2026-10-20T02:26:43Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 1,
            "suspicious": 0,
            "undetected": 35
        },
        "detections": {
            "Gridinsoft": "phishing"
        },
        "reputation": 0,
        "popularity": {
            "Cloudflare Radar": 1000000
        },
        "created": "2025-10-08T00:00:00Z",
        "first_seen": "2025-10-08T17:09:42Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "MX",
                "value": "park-mx.above.com",
                "priority": 10
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 ip6:fdcf:abda:4154::/48 -all"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "103.224.212.142"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "hostmaster.trellian.com",
                "value": "ns1.abovedomains.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.abovedomains.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.abovedomains.com"
            }
        ],
        "dns_at": "2026-10-20T02:32:44Z",
        "jarm": "28d28d28d00028d00042d42d00000051af7d8070a18e002eaaedf620fa118c",
        "cert": {
            "san": [
                "*.4526.de",
                "*.88932.my",
                "*.ape-xmedia247.digital",
                "*.aurnelis.com",
                "*.bankroll.icu",
                "*.bjblc.com.cn",
                "*.cashcowbountyboard.com",
                "*.chegouminhacompra.sbs",
                "*.coloradomarriage.com",
                "*.desiremovies.it.com"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "52550e73584761df285fbc191d512a4074a",
            "sha256": "19e81570d01c8ef3400ce14adfa1302dae8cd50fc5288db28a169791d383632a",
            "subject": "w3t61ecd.top",
            "valid_to": "2027-01-08T04:32:12Z",
            "valid_from": "2026-10-10T04:32:13Z"
        },
        "whois": []
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T06:26:11Z",
        "mail_config": {
            "mx": [
                "park-mx.above.com"
            ],
            "spf": "v=spf1 ip6:fdcf:abda:4154::/48 -all",
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "device-tracker.us"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-25T06:22:14Z",
            "first": "2026-10-25T06:22:14Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 8582
        },
        "robots_txt": {
            "present": true
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "no_sri": [
                "https://assets.abovedomains.com/javascript/forsale.min.js"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 765,
                "tls": 167,
                "wait": 333,
                "connect": 156,
                "download": 156
            },
            "response_ms": 1577
        },
        "tls_connection": {
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80
            ]
        },
        "carbon": {
            "bytes": 27610,
            "co2_grams": 0.001,
            "cleaner_than": 50
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "103.224.212.51",
                    "host": "ns2.abovedomains.com"
                },
                {
                    "ip": "103.224.182.9",
                    "host": "ns1.abovedomains.com"
                }
            ],
            "zone": "device-tracker.us"
        },
        "location": {
            "ip": "103.224.212.142",
            "asn": "133618",
            "org": "Trellian Pty. Limited",
            "country": "AU"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "w3t61ecd.top"
        },
        "dns": {
            "A": [
                "103.224.212.142"
            ],
            "MX": [
                "{\"exchange\": \"park-mx.above.com\", \"priority\": 10}"
            ],
            "NS": [
                "ns1.abovedomains.com",
                "ns2.abovedomains.com"
            ],
            "SOA": "{\"nsname\": \"ns1.abovedomains.com\", \"hostmaster\": \"hostmaster.trellian.com\", \"serial\": 2026102517, \"refresh\": 10800, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3600}",
            "TXT": [
                "v=spf1 ip6:fdcf:abda:4154::/48 -all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "103.224.212.142",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://device-tracker.us"
            ]
        },
        "linked_pages": {
            "internal_count": 1
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2025-10-08T17:17:35Z",
            "updated": "2026-10-09T20:17:55Z",
            "expires": "2026-10-08T17:17:35Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "autoRenewPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "5014.ns2.abovedomains.com",
                "5014.ns1.abovedomains.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "Apache",
                "content-type": "text/html; charset=UTF-8"
            }
        }
    }
}
```