# PhishDestroy domain threat record: disneyrecaptcha.sportemis.bid

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/disneyrecaptcha.sportemis.bid/
Machine-readable companion: https://phishdestroy.io/domain/disneyrecaptcha.sportemis.bid/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-25 08:25:04 UTC
- Last availability or vendor check: 2026-10-25 11:00:28 UTC
- Stored record updated: 2026-10-25 15:21:52 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.96.1
- Registrar in stored WHOIS data: Cloudflare, Inc.
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 404
- Registration date in stored WHOIS data: 2026-08-31 10:39:52 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0f26e-2045-77df-a640-50748222805e/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/disneyrecaptcha.sportemis.bid
- Certificate Transparency search: https://crt.sh/?q=%25.disneyrecaptcha.sportemis.bid
- Web Archive lookup: https://web.archive.org/web/*/https://disneyrecaptcha.sportemis.bid/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added disneyrecaptcha.sportemis.bid to its internal blocklist on 2026-10-25 based on an intake citing 14 malicious VirusTotal detections. A page fetch on that date returned HTTP 520 with no title captured. The domain was first seen by PhishDestroy on 2026-10-25 and external public blocklists did not list it at that time.

How the scam works
The listing reflects automated detections of phishing or malware risk; no specific malicious payload or credential-harvesting form was observed on the captured page, so the exact mechanism remains unconfirmed.

Evidence
VirusTotal reported 14 malicious and 2 suspicious detections out of 92 engines on 2026-10-20, with vendors such as BitDefender, Kaspersky and Fortinet labeling it phishing. Google Safe Browsing checked on 2026-10-25 did not flag the domain. A URLScan capture on 2026-09-30 gave a clean verdict. OTX showed zero pulses as of 2026-10-25, and external blocklists returned no matches, while PhishDestroy’s own list marked the domain as blocked.

Infrastructure
Recorded DNS on 2026-10-20 returned A records 172.67.218.250 and 104.21.24.141 for the domain. A later web check on 2026-10-25 observed Cloudflare name servers and an active Cloudflare WAF; ports 80, 443 and 8080 were recorded as open. The TLS certificate issued by Google Trust Services was valid until 2026-11-29 and DNSSEC was not enabled.

What to do
Visitors should avoid entering any credentials or downloading files from this domain; if credentials were submitted, change the associated passwords immediately. Organizations should block the exact hostname in firewalls and monitor logs for any connections to the listed IPs. Continue to watch for updated detections from security vendors.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0f26e-2045-77df-a640-50748222805e/
Cloudflare Radar report: https://radar.cloudflare.com/scan/e363ad0f-d8b9-40e0-81f9-fd3bf9f41fba
Stored capture screenshot: https://urlscan.io/screenshots/01a0f26e-2045-77df-a640-50748222805e.png
Cloudflare Radar screenshot (2026-10-25T08:35:56Z): https://screenshots.phishdestroy.io/cf/e363ad0f-d8b9-40e0-81f9-fd3bf9f41fba.png
URLScan screenshot (2026-09-29T16:00:38Z): https://screenshots.phishdestroy.io/us/01a0ede5-46a5-716d-bfb7-102b08ee0807.png
URLScan capture report: https://urlscan.io/result/01a0ede5-46a5-716d-bfb7-102b08ee0807/
VirusTotal report: https://www.virustotal.com/gui/domain/disneyrecaptcha.sportemis.bid
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=disneyrecaptcha.sportemis.bid
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 08:39:39 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0f26e-2045-77df-a640-50748222805e.png
  Captured: 2026-10-25 08:25:04 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0f26e-2045-77df-a640-50748222805e.png
  Source report: https://urlscan.io/result/01a0f26e-2045-77df-a640-50748222805e/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e363ad0f-d8b9-40e0-81f9-fd3bf9f41fba.png
  Captured: 2026-10-25 08:35:56 UTC
  Source report: https://radar.cloudflare.com/scan/e363ad0f-d8b9-40e0-81f9-fd3bf9f41fba
  SHA-256: 8adc75323db11fd34bc25129e745d7f75b9e943431674b8e360f9ba843095609
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0ede5-46a5-716d-bfb7-102b08ee0807.png
  Captured: 2026-09-29 16:00:38 UTC
  Source report: https://urlscan.io/result/01a0ede5-46a5-716d-bfb7-102b08ee0807/
  SHA-256: 60055fddb0df07fb078bf04eb82e597507567f58e750638831a20e844d221f7d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T09:16:36Z",
        "uuid": "01a0f26e-2045-77df-a640-50748222805e",
        "scanned_at": "2026-09-30T13:08:26Z",
        "final_url": "https://disneyrecaptcha.sportemis.bid/",
        "status": 520,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://disneyrecaptcha.sportemis.bid/",
                "from": "http://disneyrecaptcha.sportemis.bid/",
                "status": 307
            }
        ],
        "ip": "104.21.24.141",
        "ips": [
            "104.21.24.141"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.cloudflare.com",
            "developers.cloudflare.com"
        ],
        "doc_hash": "3ac010b9a0d2991bdc995909db59c03115e14253ec8862f98fc16572f63c9902",
        "globals": [
            "requestResize"
        ],
        "tls": {
            "san": [
                "sportemis.bid",
                "*.sportemis.bid"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "sportemis.bid",
            "protocol": "QUIC",
            "valid_to": "2026-11-29T12:39:57Z",
            "valid_from": "2026-08-31T11:43:29Z"
        },
        "domain_age_days": 5,
        "apex_age_days": 30,
        "tls_age_days": 30,
        "tls_valid_days": 90,
        "requests": 8,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 92,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "x-frame-options": "SAMEORIGIN",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T08:39:07Z",
        "uuid": "e363ad0f-d8b9-40e0-81f9-fd3bf9f41fba",
        "scanned_at": "2026-10-25T08:35:56Z",
        "final_url": "https://disneyrecaptcha.sportemis.bid/",
        "status": 520,
        "history": [
            {
                "url": "https://disneyrecaptcha.sportemis.bid/",
                "status": 520
            }
        ],
        "dom_hash": "44f83b86670a53701e60f71195a3f41260783e3e1297f0ec6a48f6f4d16a372e",
        "doc_hash": "c5f4cd06b21e0f5c219a872318af8d2eee1cab493d753d37ce103d02d2b11594",
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "disneyrecaptcha.sportemis.bid",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "disneyrecaptcha.sportemis.bid",
                "type": "A",
                "value": "188.114.96.0"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.97.0",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Cloudflare, Inc.",
            "created": "2026-08-31T12:39:52Z",
            "updated": "2026-09-05T12:39:56Z",
            "expires": "2027-08-31T12:39:52Z",
            "nameservers": [
                "fred.ns.cloudflare.com",
                "ariella.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T08:34:41Z",
        "analysis_at": "2026-10-20T19:54:16Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 14,
            "suspicious": 2,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "phishing",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-09-24T15:18:20Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.218.250"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.24.141"
            }
        ],
        "dns_at": "2026-10-20T19:59:37Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "sportemis.bid",
                "*.sportemis.bid"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "78b998731a5afa111307994ded18f31a",
            "sha256": "2c417a2c2d92458cbfde522aee0c504896ddf54a63930aa24bc456350fe2c8bf",
            "subject": "sportemis.bid",
            "valid_to": "2026-11-29T12:39:57Z",
            "valid_from": "2026-08-31T11:43:29Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T08:39:18Z",
        "caa_records": {
            "domain": "disneyrecaptcha.sportemis.bid"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.33.113",
                    "host": "fred.ns.cloudflare.com"
                },
                {
                    "ip": "162.159.38.32",
                    "host": "ariella.ns.cloudflare.com"
                }
            ],
            "zone": "sportemis.bid"
        },
        "location": {
            "ip": "188.114.96.3",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "sportemis.bid"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "188.114.97.3",
            "family": 4
        },
        "whois": {
            "registrar": "Cloudflare, Inc.",
            "created": "2026-08-31T12:39:52Z",
            "updated": "2026-09-05T12:39:56Z",
            "expires": "2027-08-31T12:39:52Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "serverTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "fred.ns.cloudflare.com",
                "ariella.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8",
                "x-frame-options": "SAMEORIGIN",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```