# PhishDestroy domain threat record: dk-test5-63eet.ondbaasdev.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/dk-test5-63eet.ondbaasdev.com/ Machine-readable companion: https://phishdestroy.io/domain/dk-test5-63eet.ondbaasdev.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 08:25:43 UTC - Last availability or vendor check: 2026-10-27 23:05:12 UTC - Stored record updated: 2026-10-27 23:22:12 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 159.89.241.4 - Registrar in stored WHOIS data: MarkMonitor Inc. - Last stored HTTP status: 308 - Registration date in stored WHOIS data: 2025-12-09 23:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/019fb73c-557b-7329-8609-99905e23109c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/dk-test5-63eet.ondbaasdev.com - Certificate Transparency search: https://crt.sh/?q=%25.dk-test5-63eet.ondbaasdev.com - Web Archive lookup: https://web.archive.org/web/*/https://dk-test5-63eet.ondbaasdev.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy lists dk-test5-63eet.ondbaasdev.com based on a VirusTotal domain scan that returned one malicious detection from SOCRadar. The domain was first seen by PhishDestroy on 2026-10-25. The recorded page returned HTTP 404 when last checked on 2026-10-25, so no active page content could be analyzed. PhishDestroy’s intake AI flagged the domain after VirusTotal reported one malicious engine out of 92 on 2026-10-24. How the scam works A single malicious detection does not establish a specific scam mechanism such as credential theft, wallet draining, or malware distribution. Suspicious domains may be used for phishing, hosting malicious content, or other abusive purposes. Visitors should avoid interacting with the domain and treat any unsolicited links or unexpected pages as untrusted. Evidence VirusTotal reported one malicious detection (SOCRadar: phishing) out of 92 engines on 2026-10-24. Google Safe Browsing did not flag the domain on 2026-10-25. Cloudflare Radar’s domain scan on 2026-10-25 categorized the domain with malware-related risks. PhishDestroy’s internal blocklist includes the domain. External blocklists checked on 2026-10-25 showed one resolver blocking the domain via CloudFlare Family. A URLScan capture from 2026-07-31 recorded the domain’s final URL returning HTTP 404. Infrastructure The recorded IP is 159.89.241.4, hosted by DigitalOcean, LLC in the US. The domain uses DigitalOcean name servers. The TLS certificate covers hastingsmysteries.com and was issued by Let’s Encrypt. The domain age is 97 days and the apex age is 231 days as of the checks. No operator identity or affiliation can be inferred from this infrastructure. What to do Do not visit or interact with dk-test5-63eet.ondbaasdev.com. If you accessed the domain or entered credentials, change passwords only if you submitted them on a page you now believe to be untrusted. Review account activity for unauthorized actions. Security teams should block this domain at the network perimeter and investigate any internal DNS resolutions or access logs involving it. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/019fb73c-557b-7329-8609-99905e23109c/ Cloudflare Radar report: https://radar.cloudflare.com/scan/1271b880-4958-411d-8f6f-50f19d3f3968 Stored capture screenshot: https://urlscan.io/screenshots/019fb73c-557b-7329-8609-99905e23109c.png Cloudflare Radar screenshot (2026-10-25T08:35:45Z): https://screenshots.phishdestroy.io/cf/1271b880-4958-411d-8f6f-50f19d3f3968.png URLScan screenshot (2026-07-30T06:30:20Z): https://screenshots.phishdestroy.io/us/019fb1b7-66b2-77de-ad7b-d934136ee5c2.png URLScan capture report: https://urlscan.io/result/019fb1b7-66b2-77de-ad7b-d934136ee5c2/ URLScan screenshot (2026-07-30T07:48:59Z): https://screenshots.phishdestroy.io/us/019fb1ff-670a-775c-a05b-82bdc63540f5.png URLScan capture report: https://urlscan.io/result/019fb1ff-670a-775c-a05b-82bdc63540f5/ VirusTotal report: https://www.virustotal.com/gui/domain/dk-test5-63eet.ondbaasdev.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=dk-test5-63eet.ondbaasdev.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 09:20:08 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/019fb73c-557b-7329-8609-99905e23109c.png Captured: 2026-10-25 08:25:43 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/019fb73c-557b-7329-8609-99905e23109c.png Source report: https://urlscan.io/result/019fb73c-557b-7329-8609-99905e23109c/ - URLScan · 2026-07-30: https://screenshots.phishdestroy.io/us/019fb1b7-66b2-77de-ad7b-d934136ee5c2.png Captured: 2026-07-30 06:30:20 UTC Source report: https://urlscan.io/result/019fb1b7-66b2-77de-ad7b-d934136ee5c2/ SHA-256: 9d6033fea6cf942e6efa5f6bba7d3bdf0b912e081993190a40db9c6701213140 - URLScan · 2026-07-30: https://screenshots.phishdestroy.io/us/019fb1ff-670a-775c-a05b-82bdc63540f5.png Captured: 2026-07-30 07:48:59 UTC Source report: https://urlscan.io/result/019fb1ff-670a-775c-a05b-82bdc63540f5/ SHA-256: 9d6033fea6cf942e6efa5f6bba7d3bdf0b912e081993190a40db9c6701213140 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1271b880-4958-411d-8f6f-50f19d3f3968.png Captured: 2026-10-25 08:35:45 UTC Source report: https://radar.cloudflare.com/scan/1271b880-4958-411d-8f6f-50f19d3f3968 SHA-256: a5db7ab655d3900bfb2bf44f8483ca7ce06fc6f795376f14b777be50f1f0af62 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T08:37:59Z", "uuid": "019fb73c-557b-7329-8609-99905e23109c", "scanned_at": "2026-07-31T08:13:38Z", "final_url": "https://dk-test5-63eet.ondbaasdev.com/", "status": 404, "redirected": "https-only", "redirects": [ { "to": "https://dk-test5-63eet.ondbaasdev.com/", "from": "http://dk-test5-63eet.ondbaasdev.com/", "status": 307 } ], "ip": "159.89.241.4", "ips": [ "159.89.241.4" ], "asns": [ "14061" ], "countries": [ "US" ], "doc_hash": "ecf14b9ebe7061cddc7e2097a66c90692cc9c1d70d96b5f7ebdd14a0dbb61f54", "tls": { "san": [ "hastingsmysteries.com" ], "cipher": "AES_256_GCM", "issuer": "YE1", "subject": "hastingsmysteries.com", "protocol": "TLS 1.3", "valid_to": "2026-10-26T11:22:45Z", "valid_from": "2026-07-28T11:22:46Z" }, "domain_age_days": 97, "apex_age_days": 231, "tls_age_days": 2, "tls_valid_days": 89, "requests": 2, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 77, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx/1.26.3", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T08:38:01Z", "uuid": "1271b880-4958-411d-8f6f-50f19d3f3968", "scanned_at": "2026-10-25T08:35:45Z", "final_url": "https://dk-test5-63eet.ondbaasdev.com/", "history": [ { "url": "https://dk-test5-63eet.ondbaasdev.com/", "status": 0 } ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "dk-test5-63eet.ondbaasdev.com", "type": "A", "value": "159.89.241.4" } ], "dnssec_valid": false, "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "MarkMonitor Inc.", "created": "2025-12-10T22:23:37Z", "updated": "2025-12-10T22:23:38Z", "expires": "2028-12-10T22:23:37Z", "nameservers": [ "ns1.digitalocean.com", "ns2.digitalocean.com", "ns3.digitalocean.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T09:13:52Z", "analysis_at": "2026-10-24T12:17:05Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 1, "suspicious": 0, "undetected": 36 }, "detections": { "SOCRadar": "phishing" }, "reputation": 0, "tags": [ "dga" ], "created": "2025-12-10T00:00:00Z", "updated": "2025-12-10T00:00:00Z", "first_seen": "2026-04-24T19:21:16Z", "dns": [ { "ttl": 300, "type": "A", "value": "159.89.241.4" } ], "dns_at": "2026-10-24T12:23:41Z", "jarm": "28d28d28d00028d00042d42d000000e1ea2a807a629b496b664cf07ad7c08d", "cert": { "san": [ "hastingsmysteries.com" ], "issuer": "Let's Encrypt / YE1", "serial": "63e1fab4bd908353d5f89daf3fea8df4175", "sha256": "26581046f973d643509f559131b3460be75ba89b3332565cff97899d7691f1b5", "subject": "hastingsmysteries.com", "valid_to": "2026-10-26T11:22:45Z", "valid_from": "2026-07-28T11:22:46Z" }, "whois": [] }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T08:38:21Z", "caa_records": { "domain": "dk-test5-63eet.ondbaasdev.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "ports": { "open": [ 22, 80, 443 ] }, "dns_server": { "ns": [ { "ip": "172.64.53.21", "host": "ns2.digitalocean.com" }, { "ip": "172.64.49.209", "host": "ns3.digitalocean.com" }, { "ip": "172.64.52.210", "host": "ns1.digitalocean.com" } ], "zone": "ondbaasdev.com" }, "location": { "ip": "159.89.241.4", "asn": "14061", "org": "DigitalOcean, LLC", "city": "Clifton", "country": "US" }, "dns": { "A": [ "159.89.241.4" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "get_ip": { "ip": "159.89.241.4", "family": 4 }, "whois": { "registrar": "MarkMonitor Inc.", "created": "2025-12-10T22:23:37Z", "updated": "2025-12-10T22:23:38Z", "expires": "2028-12-10T22:23:37Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp", "clientUpdateProhibited https://icann.org/epp" ], "nameservers": [ "ns1.digitalocean.com", "ns2.digitalocean.com", "ns3.digitalocean.com" ] } } } ```