# PhishDestroy domain threat record: dndair.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/dndair.com/ Machine-readable companion: https://phishdestroy.io/domain/dndair.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-24 00:12:39 UTC - Last availability or vendor check: 2026-10-26 00:03:37 UTC - Stored record updated: 2026-10-26 07:21:22 UTC - VirusTotal detections in the stored snapshot: 17/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: flagged ## Stored classification - Targeted brand: adobe ## Stored infrastructure - Observed IP address: 50.87.143.172 - Registrar in stored WHOIS data: Bluehost Inc. - Registrar country in stored WHOIS data: US - Last stored HTTP status: 200 - Registration date (registry RDAP, dndair.com): 2012-01-13 23:06:15 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16b43-041c-76ee-9695-401bf4e83113/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/dndair.com - Certificate Transparency search: https://crt.sh/?q=%25.dndair.com - Web Archive lookup: https://web.archive.org/web/*/https://dndair.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed dndair.com as a suspicious domain because it triggered social‑engineering warnings. The site was first seen by PhishDestroy on 2026-10-24 and returned HTTP 200 at that time. The recorded page title advertises a heating and air‑conditioning business, which does not match the phishing indicators. Google Safe Browsing and VirusTotal both flagged the domain on the same date. How the scam works The detections point to a generic phishing approach that attempts to harvest credentials or personal data by presenting fake login or request pages. Such pages often mimic well‑known services—urlscan identified brand cues for OneDrive, Adobe and generic email—to lure victims into entering sensitive information. No specific malicious payload or wallet‑draining behavior was observed on the captured pages. Evidence VirusTotal reported 17 detections across 92 engines on 2026-10-24, with 16 classified as malicious and 1 as suspicious; vendors included BitDefender, Fortinet, AlphaMountain.ai and Google Safe Browsing. Google Safe Browsing flagged the domain for SOCIAL_ENGINEERING on 2026-10-24. urlscan captured a redirect to /iv/cook/index.php and gave an overall malicious verdict (score 100, category phishing) on 2026-10-24, citing OneDrive and Adobe brands. The external blocklist PhishFeed also listed the domain, and OTX recorded six pulses mentioning it as of 2026-10-24. Infrastructure The domain was registered with Bluehost Inc. on 2012-01-13 and is set to expire on 2027-01-13. The recorded DNS A record pointed to 50.87.143.172, which the rdap data listed as a Unified Layer server located in the United States. TLS is provided by Let’s Encrypt (certificate valid 2026-10-15 to 2027-01-13) and includes multiple service subdomains. Open ports include standard web, mail and database services. What to do Visitors should avoid entering any credentials on dndair.com and, if they have already done so, change the affected passwords and enable multi‑factor authentication. Security teams should block the domain at the network perimeter, monitor DNS logs for queries to dndair.com, and add the domain to internal blocklists. No wallet‑related actions are required because wallet recommendations are disabled for this listing. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16b43-041c-76ee-9695-401bf4e83113/ Cloudflare Radar report: https://radar.cloudflare.com/scan/e7ede349-b59e-416e-9aa4-c9d85fbf04e9 URLQuery report: https://urlquery.net/report/fe0a5d5d-cbb9-4926-8384-d52b6f793c75 Stored capture screenshot: https://i.ibb.co/v4Qtm9n2/abfef81eb90e.png Cloudflare Radar screenshot (2026-10-24T00:15:29Z): https://screenshots.phishdestroy.io/cf/e7ede349-b59e-416e-9aa4-c9d85fbf04e9.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/fe0a5d5d-cbb9-4926-8384-d52b6f793c75.png URLScan screenshot (2026-09-29T10:35:10Z): https://screenshots.phishdestroy.io/us/01a0ecbb-6219-72f1-99a3-6a54c3813ecb.png URLScan capture report: https://urlscan.io/result/01a0ecbb-6219-72f1-99a3-6a54c3813ecb/ URLScan screenshot (2026-09-30T04:47:41Z): https://screenshots.phishdestroy.io/us/01a0f0a3-aad0-74f0-8ed5-1a3d3adcdb7e.png URLScan capture report: https://urlscan.io/result/01a0f0a3-aad0-74f0-8ed5-1a3d3adcdb7e/ URLScan screenshot (2026-09-30T17:57:49Z): https://screenshots.phishdestroy.io/us/01a0f376-f519-7119-9624-2429be97ea39.png URLScan capture report: https://urlscan.io/result/01a0f376-f519-7119-9624-2429be97ea39/ URLScan screenshot (2026-10-05T22:26:07Z): https://screenshots.phishdestroy.io/us/01a10e2c-8185-711e-bdfe-b34cd7b0931e.png URLScan capture report: https://urlscan.io/result/01a10e2c-8185-711e-bdfe-b34cd7b0931e/ URLScan screenshot (2026-10-16T01:24:01Z): https://screenshots.phishdestroy.io/us/01a1424e-fc60-70e0-9078-fe568f07c308.png URLScan capture report: https://urlscan.io/result/01a1424e-fc60-70e0-9078-fe568f07c308/ VirusTotal report: https://www.virustotal.com/gui/domain/dndair.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=dndair.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-24 01:17:41 UTC ## Stored page captures - Primary capture: https://i.ibb.co/v4Qtm9n2/abfef81eb90e.png Captured: 2026-10-24 00:16:44 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a16b43-041c-76ee-9695-401bf4e83113.png Captured: 2026-10-24 00:16:44 UTC Source report: https://urlscan.io/result/01a16b43-041c-76ee-9695-401bf4e83113/ - URLScan capture 2: https://urlscan.io/screenshots/01a1424e-fc60-70e0-9078-fe568f07c308.png Captured: 2026-10-24 00:12:39 UTC Source report: https://urlscan.io/result/01a16b43-041c-76ee-9695-401bf4e83113/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e7ede349-b59e-416e-9aa4-c9d85fbf04e9.png Captured: 2026-10-24 00:15:29 UTC Source report: https://radar.cloudflare.com/scan/e7ede349-b59e-416e-9aa4-c9d85fbf04e9 SHA-256: 210e126bc0a43f266482a9223e824223aca9e44843801054303c8ed91a5dea64 - URLQuery: https://screenshots.phishdestroy.io/uq/fe0a5d5d-cbb9-4926-8384-d52b6f793c75.png Source report: https://urlquery.net/report/fe0a5d5d-cbb9-4926-8384-d52b6f793c75 SHA-256: 4f2b3701edeca8550ab7b51d897c091dc694e927e6bb31e84cbfc1acf29353a3 - URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0ecbb-6219-72f1-99a3-6a54c3813ecb.png Captured: 2026-09-29 10:35:10 UTC Source report: https://urlscan.io/result/01a0ecbb-6219-72f1-99a3-6a54c3813ecb/ SHA-256: 6576a305e5683644093637c6cdfb15a377b0e0c433184c920d34b84f744391f2 - URLScan · 2026-09-30: https://screenshots.phishdestroy.io/us/01a0f0a3-aad0-74f0-8ed5-1a3d3adcdb7e.png Captured: 2026-09-30 04:47:41 UTC Source report: https://urlscan.io/result/01a0f0a3-aad0-74f0-8ed5-1a3d3adcdb7e/ SHA-256: e9f0082114e4f4e7be8d7abc403090f3f989fd623b5c5035088614d6066e39da - URLScan · 2026-09-30: https://screenshots.phishdestroy.io/us/01a0f376-f519-7119-9624-2429be97ea39.png Captured: 2026-09-30 17:57:49 UTC Source report: https://urlscan.io/result/01a0f376-f519-7119-9624-2429be97ea39/ SHA-256: 3845c3b2feaca006f974b662ef90451e568e5e41d75f3c89fcacbd8ed245af54 - URLScan · 2026-10-05: https://screenshots.phishdestroy.io/us/01a10e2c-8185-711e-bdfe-b34cd7b0931e.png Captured: 2026-10-05 22:26:07 UTC Source report: https://urlscan.io/result/01a10e2c-8185-711e-bdfe-b34cd7b0931e/ SHA-256: b02737ff169ae2f13c7b49d5f2c8f07f0dc85d37bb5257f0c65033b50832a32d - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1424e-fc60-70e0-9078-fe568f07c308.png Captured: 2026-10-16 01:24:01 UTC Source report: https://urlscan.io/result/01a1424e-fc60-70e0-9078-fe568f07c308/ SHA-256: b02737ff169ae2f13c7b49d5f2c8f07f0dc85d37bb5257f0c65033b50832a32d ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-24T00:47:35Z", "uuid": "01a16b43-041c-76ee-9695-401bf4e83113", "scanned_at": "2026-10-24T00:15:24Z", "final_url": "https://dndair.com/iv/cook/index.php", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://dndair.com/iv/doc.html", "from": "http://dndair.com/iv/doc.html", "status": 307 }, { "to": "https://dndair.com/iv/cook/index.php", "from": "https://dndair.com/iv/doc.html" } ], "ip": "50.87.143.172", "ptr": "box2492.bluehost.com", "domains": [ "code.jquery.com", "maxcdn.bootstrapcdn.com", "cdnjs.cloudflare.com", "1000logos.net", "e7.pngegg.com", "kit.fontawesome.com", "fonts.googleapis.com", "ajax.googleapis.com" ], "ips": [ "104.17.24.14", "104.26.8.175", "188.114.96.3", "172.64.147.188", "142.251.13.95", "104.18.10.207", "151.101.129.155", "142.251.14.95", "50.87.143.172" ], "asns": [ "13335", "15169", "54113", "46606" ], "countries": [ "US" ], "link_domains": [ "msfwtmifbs.jerimavon.com", "accounts.clarkservic.icu" ], "globals": [ "$", "jQuery", "openPopup", "closePopup", "disp_pass", "hide_pass", "Popper", "bootstrap", "popupNode", "passBox" ], "tls": { "san": [ "autoconfig.dndair.com", "autodiscover.dndair.com", "cpanel.dndair.com", "cpcalendars.dndair.com", "cpcontacts.dndair.com", "dndair.com", "mail.dndair.com", "webdisk.dndair.com", "webmail.dndair.com", "www.dndair.com" ], "cipher": "AES_256_GCM", "issuer": "YR1", "subject": "cpcalendars.dndair.com", "protocol": "TLS 1.3", "valid_to": "2027-01-13T13:49:41Z", "valid_from": "2026-10-15T13:49:42Z" }, "domain_age_days": 2635, "apex_age_days": 2635, "tls_age_days": 8, "tls_valid_days": 89, "requests": 26, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "onedrive", "adobe", "genericemail", "generic" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "OneDrive", "Adobe", "Generic Email", "Generic" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "Apache", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-24T00:16:04Z", "uuid": "e7ede349-b59e-416e-9aa4-c9d85fbf04e9", "scanned_at": "2026-10-24T00:15:29Z", "final_url": "https://dndair.com/", "status": 200, "history": [ { "url": "https://dndair.com/", "status": 200 } ], "dom_hash": "07ccb28812bc4018cd6bb3789f4a068d2851c0e6af5e6ea5fb6d469716fa0097", "doc_hash": "56c98d1295921d9eafbc4de142b811b6f147e9fe3e257ec1239d55e9a656139a", "domain_risks": [ "Compromised Domain", "Security threats", "Home & Garden", "Society & Lifestyle", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "dndair.com", "type": "A", "value": "50.87.143.172" } ], "dnssec_valid": false, "ip": "50.87.143.172", "whois": { "registrar": "Bluehost Inc.", "created": "2012-01-13T23:06:15Z", "updated": "2023-05-18T20:04:00Z", "expires": "2027-01-13T23:06:15Z", "nameservers": [ "ns1.bluehost.com", "ns2.bluehost.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-24T01:17:05Z", "analysis_at": "2026-10-23T18:17:19Z", "stats": { "timeout": 0, "harmless": 45, "malicious": 16, "suspicious": 1, "undetected": 30 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "VIPRE": "malware", "G-Data": "malware", "Lionic": "phishing", "Sophos": "phishing", "Certego": "phishing", "Emsisoft": "malware", "Fortinet": "malware", "SOCRadar": "phishing", "URLQuery": "malicious", "Seclookup": "malicious", "Gridinsoft": "phishing", "BitDefender": "malware", "alphaMountain.ai": "phishing", "Google Safe Browsing": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "popularity": { "Alexa": 418888, "Statvoo": 243201 }, "registrar": "Bluehost Inc.", "created": "2012-01-13T23:06:15Z", "expires": "2027-01-13T23:06:15Z", "updated": "2023-11-14T08:35:58Z", "first_seen": "2023-10-10T08:54:34Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "ns2.bluehost.com" }, { "ttl": 21600, "type": "NS", "value": "ns1.bluehost.com" }, { "ttl": 14400, "type": "A", "value": "50.87.143.172" }, { "ttl": 21600, "type": "SOA", "rname": "root.box2492.bluehost.com", "value": "ns1.bluehost.com" }, { "ttl": 14400, "type": "MX", "value": "mail.dndair.com", "priority": 0 }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 a mx include:websitewelcome.com ~all" } ], "dns_at": "2026-10-23T18:22:43Z", "jarm": "29d29d15d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1", "cert": { "san": [ "autoconfig.dndair.com", "autodiscover.dndair.com", "cpanel.dndair.com", "cpcalendars.dndair.com", "cpcontacts.dndair.com", "dndair.com", "mail.dndair.com", "webdisk.dndair.com", "webmail.dndair.com", "www.dndair.com" ], "issuer": "Let's Encrypt / YR1", "serial": "65f2215e101d265a119af2b54223355503b", "sha256": "ff834ffed830b5ae120ece753140e57d1d962d7c651e676aaa4742b791c4310e", "subject": "cpcalendars.dndair.com", "valid_to": "2027-01-13T13:49:41Z", "valid_from": "2026-10-15T13:49:42Z" }, "whois": { "registrar": "Bluehost Inc.", "registrar_iana_id": "1154", "registrar_url": "https://www.bluehost.com", "created": "2012-01-13T23:06:15Z", "updated": "2023-05-18T20:04:00Z", "expires": "2027-01-13T23:06:15Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1.bluehost.com", "ns2.bluehost.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-01-13T23:06:15Z", "last changed": "2023-05-18T20:04:00Z", "registration": "2012-01-13T23:06:15Z", "last update of RDAP database": "2026-10-23T13:59:35Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-24T00:16:20Z", "mail_config": { "mx": [ "mail.dndair.com" ], "spf": "v=spf1 a mx include:websitewelcome.com ~all", "dkim": [ "default" ], "dkim_bits": 2048, "spf_lookups": 10 }, "caa_records": { "domain": "dndair.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-24T00:13:28Z", "first": "2013-04-08T00:22:34Z", "changes": 78, "days_archived": 92, "scans_per_day": 0.02, "avg_page_bytes": 6300 }, "robots_txt": { "agents": [ "*" ], "present": true }, "sitemap": { "present": true, "url_count": 2500 }, "social_tags": { "title": "DND Heating & Air Conditioning – AC Repair and installation for home & office", "robots": "max-image-preview:large", "generator": "WordPress 7.1.3", "canonicalUrl": "https://dndair.com/" }, "trackers": { "requests": 46, "trackers": [ { "name": "fontawesome.com", "company": "fontawesome.com", "category": "Hosting", "requests": 2 } ] }, "mixed_content": { "no_sri": [ "https://widget.tagembed.com/embed.min.js" ], "passive_insecure": [ "http://changingseo.com/banquet1/wp-content/uploads/2023/03/cropped-Mckinneyairconditioningrepair.png", "http://changingseo.com/banquet1/wp-content/uploads/2025/07/20221017_122651.jpg", "http://changingseo.com/banquet1/wp-content/uploads/2025/07/daveprofile.png", "http://changingseo.com/banquet1/wp-content/uploads/2023/03/Heating-Air-Conditioning-Repair-McKinney-scaled-1.jpg", "http://changingseo.com/banquet1/wp-content/uploads/2025/07/Attic-Insulation-scaled.jpg" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 39, "tls": 166, "wait": 640, "connect": 165, "download": 656 }, "response_ms": 1666 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 22, 25, 53, 80, 110, 143, 443, 587, 993, 995, 3306 ] }, "carbon": { "bytes": 204764, "co2_grams": 0.0075, "cleaner_than": 6 }, "dns_server": { "ns": [ { "ip": "162.159.25.175", "host": "ns2.bluehost.com" }, { "ip": "162.159.24.80", "host": "ns1.bluehost.com" } ], "zone": "dndair.com" }, "location": { "ip": "50.87.143.172", "asn": "46606", "org": "Unified Layer", "city": "Phoenix", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "cpcalendars.dndair.com" }, "dns": { "A": [ "50.87.143.172" ], "MX": [ "{\"exchange\": \"mail.dndair.com\", \"priority\": 0}" ], "NS": [ "ns1.bluehost.com", "ns2.bluehost.com" ], "SOA": "{\"nsname\": \"ns1.bluehost.com\", \"hostmaster\": \"root.box2492.bluehost.com\", \"serial\": 2021053103, \"refresh\": 86400, \"retry\": 7200, \"expire\": 3600000, \"minttl\": 300}", "TXT": [ "v=spf1 a mx include:websitewelcome.com ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": "private-state-token-redemption=(self \"https://www.google.com\" \"https://www.gstatic.com\" \"https://recaptcha.net\" \"https:/", "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "50.87.143.172", "family": 4 }, "redirects": { "chain": [ "https://dndair.com" ] }, "subdomains": { "count": 9, "subdomains": [ "autoconfig.dndair.com", "autodiscover.dndair.com", "cpanel.dndair.com", "cpcalendars.dndair.com", "cpcontacts.dndair.com", "mail.dndair.com", "webdisk.dndair.com", "webmail.dndair.com", "www.dndair.com" ] }, "linked_pages": { "external": [ "https://www.facebook.com/DNDAIR/", "https://www.youtube.com/@dndheatingairconditioning6759", "https://g.page/r/CXSNpsq4Lda7EBM/review", "http://tel//+19722342665", "https://changingseo.com/" ], "external_count": 5, "internal_count": 14 }, "whois": { "registrar": "Bluehost Inc.", "created": "2012-01-13T23:06:15Z", "updated": "2023-05-18T20:04:00Z", "expires": "2027-01-13T23:06:15Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.bluehost.com", "ns2.bluehost.com" ] }, "headers": { "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8", "permissions-policy": "private-state-token-redemption=(self \"https://www.google.com\" \"https://www.gstatic.com\" \"https://recaptcha.net\" \"https://challenges.cloudflare.com\" \"https://hcaptcha.com\"), private-state-token-issuance=(self \"https://www.google.com\" \"https://www.gstatic.com\" \"https://recaptcha.net\" \"https://challeng" } } } } ```