# PhishDestroy domain threat record: duke-pristo.org Content language: English Canonical HTML report: https://phishdestroy.io/domain/duke-pristo.org/ Machine-readable companion: https://phishdestroy.io/domain/duke-pristo.org/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-26 04:00:15 UTC - Stored record updated: 2026-10-26 04:30:35 UTC - VirusTotal detections in the stored snapshot: 17/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 103.224.212.141 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2025-09-18 09:52:11 UTC ## Evidence links - URLScan report: https://urlscan.io/result/019fbc45-f5cf-77bb-a559-934bbb28658c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/duke-pristo.org - Certificate Transparency search: https://crt.sh/?q=%25.duke-pristo.org - Web Archive lookup: https://web.archive.org/web/*/https://duke-pristo.org/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed duke-pristo.org on 2026-10-26 after its intake flagged the domain because VirusTotal returned fourteen malicious vendor detections. The site returned HTTP 200 on the same day, but no page title was recorded. The domain was first seen by PhishDestroy on 2026-10-26. How the scam works The detections indicate the domain could be used for typical malicious activities such as hosting malware or phishing pages, but no concrete payload, credential‑harvesting form, or malicious script was observed in the captured page. Evidence VirusTotal analysis on 2026-10-21 reported 14 malicious and 3 suspicious detections from 92 engines, totaling 17 detections. Google Safe Browsing checked on 2026-10-26 and reported no threat. URLScan captured the site on 2026-08-01; its overall verdict was clean, though its engine score flagged it as malicious. Cloudflare Radar scanned on 2026-10-26 and labeled the domain malicious with a malware category. OTX listed one pulse referencing the domain on 2026-10-26. PhishDestroy’s internal blocklist marks the domain as blocked, while external blocklists checked on 2026-10-26 returned zero hits. Infrastructure The recorded registration shows the domain was created on 2025-09-18 by Dynadot Inc, giving it an age of 316 days at the time of the latest check. The recorded IP was 103.224.212.141, which belonged to the TRELLIAN network in Australia at the time of observation. The site was observed behind Cloudflare, as indicated by the server header. TLS inspection on 2026-10-26 found a Let’s Encrypt certificate issued to getpharma.com, valid from 2026-09-18 to 2026-12-17. Authoritative nameservers were ns1.abovedomains.com and ns2.abovedomains.com. What to do Avoid entering any credentials, personal data, or downloading files from duke-pristo.org. If you have already submitted login information, change the associated passwords and monitor the accounts for suspicious activity. Defenders should block the domain at network perimeters, monitor DNS queries for 103.224.212.141, and update threat feeds with the PhishDestroy listing. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/019fbc45-f5cf-77bb-a559-934bbb28658c/ Cloudflare Radar report: https://radar.cloudflare.com/scan/40412d76-33cc-491f-a837-ec4c146d6191 Stored capture screenshot: https://urlscan.io/screenshots/019fbc45-f5cf-77bb-a559-934bbb28658c.png Cloudflare Radar screenshot (2026-10-26T04:00:48Z): https://screenshots.phishdestroy.io/cf/40412d76-33cc-491f-a837-ec4c146d6191.png URLScan screenshot (2026-07-31T15:30:24Z): https://screenshots.phishdestroy.io/us/019fb8cc-33bd-7589-92bc-0786c57ec057.png URLScan capture report: https://urlscan.io/result/019fb8cc-33bd-7589-92bc-0786c57ec057/ VirusTotal report: https://www.virustotal.com/gui/domain/duke-pristo.org Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=duke-pristo.org Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 04:02:27 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/019fbc45-f5cf-77bb-a559-934bbb28658c.png Captured: 2026-10-26 04:00:15 UTC - URLScan capture: https://screenshots.phishdestroy.io/019fbc45-f5cf-77bb-a559-934bbb28658c.png Captured: 2026-10-26 04:30:35 UTC Source report: https://urlscan.io/result/019fbc45-f5cf-77bb-a559-934bbb28658c/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/40412d76-33cc-491f-a837-ec4c146d6191.png Captured: 2026-10-26 04:00:48 UTC Source report: https://radar.cloudflare.com/scan/40412d76-33cc-491f-a837-ec4c146d6191 SHA-256: f846031c06660947d1f7d3ad32ac0ae76e9b52ac2030888929aa1f43c5bb5a5f - URLScan · 2026-07-31: https://screenshots.phishdestroy.io/us/019fb8cc-33bd-7589-92bc-0786c57ec057.png Captured: 2026-07-31 15:30:24 UTC Source report: https://urlscan.io/result/019fb8cc-33bd-7589-92bc-0786c57ec057/ SHA-256: cb3faa6e2a2e312cf5f23a36b3c478cb0b3b71aa2518cd8ada637e94ace274cb ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T04:01:45Z", "uuid": "019fbc45-f5cf-77bb-a559-934bbb28658c", "scanned_at": "2026-08-01T07:42:15Z", "final_url": "https://duke-pristo.org/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://duke-pristo.org/", "from": "http://duke-pristo.org/", "status": 307 } ], "ip": "188.114.97.3", "domains": [ "fonts.gstatic.com", "db.onlinewebfonts.com", "fonts.googleapis.com", "ajax.googleapis.com", "ipinfo.io" ], "ips": [ "188.114.96.3", "142.250.154.94", "2a00:1450:4001:c15::5f", "2a00:1450:4001:c17::5f", "188.114.97.3" ], "asns": [ "13335", "15169" ], "countries": [ "US", "DE" ], "doc_hash": "3d1d3c6667c7cf39194174baa8bd8f9d154691189c922ca527ef4a6a8a8ddd7c", "script_hashes": [ "11c19efe33fb100c4c87c44c823302f089fafe8f91ae762087370611946fa6ee", "37b38f6e8d74bbf51083ce962cb84f03ba6a6deea4bffe86e6f21569a5d5bed8" ], "globals": [ "$", "jQuery", "_0xb61b", "_0x4678", "consts", "api", "_locals", "getLang", "getRootPath", "getPagePath", "getCookie", "joinUrl", "realOff", "fmsUrl", "FireEvent", "fadeInOnScroll", "offset", "intlTelInputGlobals", "intlTelInput", "intlTelInputUtils", "setPhoneOk", "setPhoneErr", "setEmailOk", "setEmailErr", "setFNameOk", "setFNameErr", "setLNameOk", "setLNameErr", "setFormSending", "setFormSent", "getFormData", "scrollToElem", "routerClick", "changeLang", "investmentCalculator", "toggleHowTo", "toggleFree", "getDialCode", "searchParams", "ch" ], "cookies": [ "diu" ], "storage_keys": [ "uid", "openedAt", "referer", "offer" ], "tls": { "san": [ "duke-pristo.org", "*.duke-pristo.org" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "duke-pristo.org", "protocol": "QUIC", "valid_to": "2026-10-13T14:02:31Z", "valid_from": "2026-07-15T13:04:02Z" }, "domain_age_days": 316, "apex_age_days": 316, "tls_age_days": 16, "tls_valid_days": 90, "requests": 57, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T04:01:48Z", "uuid": "40412d76-33cc-491f-a837-ec4c146d6191", "scanned_at": "2026-10-26T04:00:48Z", "final_url": "https://duke-pristo.org/", "status": 200, "history": [ { "url": "https://duke-pristo.org/", "status": 200 } ], "dom_hash": "f737d713dbf8c2aa26cc80eb4c4bbd657f709164e12199b75b72a4d0c4d8e763", "doc_hash": "3d712811971add75b9a1f81103799bb53a65e8afd4fb9e8122deadb4c7990d23", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "duke-pristo.org", "type": "A", "value": "103.224.212.141" } ], "dnssec_valid": false, "ip": "103.224.212.141", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2025-09-18T11:52:11Z", "updated": "2026-09-18T17:57:32Z", "expires": "2027-09-18T11:52:11Z", "nameservers": [ "5014.ns1.abovedomains.com", "5014.ns2.abovedomains.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T04:00:39Z", "analysis_at": "2026-10-21T13:56:19Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 14, "suspicious": 3, "undetected": 31 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Emsisoft": "malware", "Fortinet": "phishing", "SOCRadar": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "Dynadot Inc", "created": "2025-09-18T11:52:11Z", "expires": "2027-09-18T11:52:11Z", "updated": "2026-09-18T17:57:32Z", "first_seen": "2025-09-18T12:47:27Z", "dns": [ { "ttl": 3600, "type": "TXT", "value": "v=spf1 ip6:fdcf:abda:4154::/48 -all" }, { "ttl": 3600, "type": "MX", "value": "park-mx.above.com", "priority": 10 }, { "ttl": 21600, "type": "NS", "value": "ns2.abovedomains.com" }, { "ttl": 21600, "type": "NS", "value": "ns1.abovedomains.com" }, { "ttl": 3600, "type": "SOA", "rname": "hostmaster.trellian.com", "value": "ns1.abovedomains.com" }, { "ttl": 3600, "type": "A", "value": "103.224.212.141" } ], "dns_at": "2026-10-21T14:02:00Z", "jarm": "28d28d28d00028d00042d42d00000051af7d8070a18e002eaaedf620fa118c", "cert": { "san": [ "*.118.getpharma.com", "*.2analyticspulse.buzz", "*.36ngame.com", "*.370913.cc", "*.58u11f.jstv2217.xyz", "*.87k.pw", "*.893175.mobi", "*.8m98hvv.jstv2217.xyz", "*.8tbuse1.jstv2217.xyz", "*.8xue8.com.cn" ], "issuer": "Let's Encrypt / YE2", "serial": "5d3c205ff6774c6cb88b877ad51ca6863d6", "sha256": "5c61e49437a2a50e50168a679ecc1e944336453b6a1affb29fc92d3849a87eb4", "subject": "getpharma.com", "valid_to": "2026-12-17T19:47:20Z", "valid_from": "2026-09-18T19:47:21Z" }, "whois": { "registrar": "Dynadot Inc", "registrar_iana_id": "472", "registrar_url": "http://www.dynadot.com", "created": "2025-09-18T11:52:11Z", "updated": "2026-09-18T17:57:32Z", "expires": "2027-09-18T11:52:11Z", "status": [ "autoRenewPeriod", "clientTransferProhibited" ], "nameservers": [ "5014.ns1.abovedomains.com", "5014.ns2.abovedomains.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2026-09-18T11:52:11Z", "last changed": "2026-10-18T11:52:44Z", "registration": "2025-09-18T11:52:11Z", "registrar expiration": "2026-09-18T11:52:11Z", "last update of RDAP database": "2026-10-21T10:20:36Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T04:02:06Z", "mail_config": { "mx": [ "park-mx.above.com" ], "spf": "v=spf1 ip6:fdcf:abda:4154::/48 -all", "spf_lookups": 0 }, "caa_records": { "domain": "duke-pristo.org" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-26T04:00:35Z", "first": "2026-03-15T18:46:45Z", "changes": 2, "days_archived": 3, "scans_per_day": 0.01, "avg_page_bytes": 8002 }, "robots_txt": { "present": true }, "mixed_content": { "no_sri": [ "https://assets.abovedomains.com/javascript/forsale.min.js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 612, "tls": 180, "wait": 364, "connect": 156, "download": 154 }, "response_ms": 1466 }, "tls_connection": { "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80 ] }, "carbon": { "bytes": 27390, "co2_grams": 0.001, "cleaner_than": 50 }, "dns_server": { "ns": [ { "ip": "103.224.182.77", "host": "ns1.abovedomains.com" }, { "ip": "103.224.212.10", "host": "ns2.abovedomains.com" } ], "zone": "duke-pristo.org" }, "location": { "ip": "103.224.212.141", "asn": "133618", "org": "TRELLIAN", "city": "Beaumaris", "country": "AU" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "getpharma.com" }, "dns": { "A": [ "103.224.212.141" ], "MX": [ "{\"exchange\": \"park-mx.above.com\", \"priority\": 10}" ], "NS": [ "ns2.abovedomains.com", "ns1.abovedomains.com" ], "SOA": "{\"nsname\": \"ns1.abovedomains.com\", \"hostmaster\": \"hostmaster.trellian.com\", \"serial\": 2026102614, \"refresh\": 10800, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3600}", "TXT": [ "v=spf1 ip6:fdcf:abda:4154::/48 -all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "103.224.212.141", "family": 4 }, "redirects": { "chain": [ "https://duke-pristo.org" ] }, "linked_pages": { "internal_count": 1 }, "whois": { "registrar": "Dynadot Inc", "created": "2025-09-18T11:52:11Z", "updated": "2026-09-18T17:57:32Z", "expires": "2027-09-18T11:52:11Z", "status": [ "clientTransferProhibited https://icann.org/epp", "autoRenewPeriod https://icann.org/epp" ], "nameservers": [ "5014.ns1.abovedomains.com", "5014.ns2.abovedomains.com" ] }, "headers": { "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8" } } } } ```