# PhishDestroy domain threat record: duplicate-disabled-211853.invalid Content language: English Canonical HTML report: https://phishdestroy.io/domain/duplicate-disabled-211853.invalid/ Machine-readable companion: https://phishdestroy.io/domain/duplicate-disabled-211853.invalid/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-04-30 23:16:40 UTC - Last availability or vendor check: 2026-10-21 01:16:26 UTC - Stored record updated: 2026-10-22 06:21:22 UTC - VirusTotal detections in the stored snapshot: 2/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 104.21.52.206 - Registrar in stored WHOIS data: NETIM - Registration date in stored WHOIS data: 2026-04-16 22:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/019de076-4370-703f-9ae2-0e9bce27c467/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/duplicate-disabled-211853.invalid - Certificate Transparency search: https://crt.sh/?q=%25.duplicate-disabled-211853.invalid - Web Archive lookup: https://web.archive.org/web/*/https://duplicate-disabled-211853.invalid/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis {"en": "PhishDestroy identifies www.persiarestaurant.no as an active credential theft phishing domain under investigation. The site impersonates a legitimate restaurant brand, likely aiming to harvest user login credentials through fake reservation forms or payment portals. No drainer kit artifacts (e.g., wallet drainer scripts) are publicly documented, but the phishing mechanism is inferred from the domain’s behavior and structure. Brand impersonation is evident via a deceptive domain closely resembling a known restaurant chain, suggesting a social engineering tactic targeting users expecting to interact with a trusted service.\n\n\nTechnical indicators confirm this domain’s malicious nature. VirusTotal analysis shows 0/95 detections at the time of review, indicating evasion of current antivirus signatures. The domain resolves to IP 104.21.52.206 and is secured with a Let’s Encrypt SSL certificate, likely to appear legitimate. Registered on April 17, 2026, through a likely privacy-protected registrar, this domain is newly active and may have evaded blocklists. Google Safe Browsing (GSB) status is unflagged, and public blocklist reports (e.g., URLVoid, PhishTank) show zero current listings—highlighting its stealth and recent deployment.\n\n\nThe domain remains active with a high-risk status pending full forensic validation. Immediate actions include domain takedown advisories to hosting providers and registrars due to active phishing behavior. Users are advised to avoid interacting with the site, especially submitting credentials or payment data. Remaining risk is high due to the domain’s newness, SSL encryption, and lack of detection coverage—posing an imminent threat to unsuspecting visitors. Monitor for updates as threat intelligence evolves.", "fr": "Hello! How can I help you today?"} Analysis generated: 2026-04-30 23:17:24 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/019de076-4370-703f-9ae2-0e9bce27c467.png Captured: 2026-04-30 23:16:40 UTC - URLScan capture: https://screenshots.phishdestroy.io/019de076-4370-703f-9ae2-0e9bce27c467.png Source report: https://urlscan.io/result/019de076-4370-703f-9ae2-0e9bce27c467/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T06:02:49Z", "uuid": "019de076-4370-703f-9ae2-0e9bce27c467", "scanned_at": "2026-04-30T22:15:52Z", "final_url": "https://www.persiarestaurant.no/meny/", "status": 200, "ip": "104.21.52.206", "domains": [ "m.media-amazon.com", "images-na.ssl-images-amazon.com", "fls-na.amazon.com", "unagi.amazon.com", "static.cloudflareinsights.com" ], "ips": [ "44.215.115.167", "44.218.242.254", "104.16.79.73", "151.101.193.16", "104.21.52.206" ], "asns": [ "14618", "13335", "54113" ], "countries": [ "US" ], "link_domains": [ "www.amazon.com", "get.adobe.com", "pmaxwin138.firebaseapp.com" ], "doc_hash": "83ab6458bd6ce86be32f1ab0cae9970bad439acb311b2cdcee20bed248028290", "globals": [ "aPageStart", "ue_t0", "ue_csm", "ue_hob", "ue_err_chan", "ue_id", "ue_url", "ue_navtiming", "ue_mid", "ue_sid", "ue_sn", "ue_furl", "ue_surl", "ue_fcsn", "ue_urt", "ue_rpl_ns", "ue_ddq", "ue_fpf", "ue_sbuimp", "ue_lpsi", "ue_lob", "ue_dsbl_cel", "ue_swi", "ue_viz", "ue_hoe", "ue_ihb", "ue", "ueLogError", "ue_err", "ueinit", "uei", "ueh", "ues", "uet", "uex", "onLd", "onLdEnd", "onUl", "onstop", "_pSetI" ], "cookies": [ "csm-hit" ], "storage_keys": [ "csm-hit", "csa.cajun.bn65pu-8vwt4w-i0m7hn-rvlkae" ], "tls": { "san": [ "*.persiarestaurant.no", "persiarestaurant.no" ], "cipher": "AES_128_GCM", "issuer": "E8", "subject": "persiarestaurant.no", "protocol": "QUIC", "valid_to": "2026-07-16T14:26:23Z", "valid_from": "2026-04-17T14:26:24Z" }, "domain_age_days": 1476, "apex_age_days": 1773, "tls_age_days": 13, "tls_valid_days": 89, "requests": 143, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -44, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T07:33:11Z", "uuid": "16b984da-83bc-431a-af02-806222527486", "scanned_at": "2026-04-30T22:16:53Z", "final_url": "https://www.persiarestaurant.no/", "status": 200, "history": [ { "url": "https://www.persiarestaurant.no/", "status": 200 } ], "dom_hash": "51ea556348408e2786c9e9cb36ab803f8148f19a640f5571103b8adc8e62854e", "doc_hash": "7585052d17548e3e81a097f153f8d16a2ee8808aa57e04b686cdc09ab5aa8d64", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "www.persiarestaurant.no", "type": "A", "value": "172.67.203.167" }, { "name": "www.persiarestaurant.no", "type": "A", "value": "104.21.52.206" }, { "name": "www.persiarestaurant.no", "type": "AAAA", "value": "2606:4700:3032::6815:34ce" }, { "name": "www.persiarestaurant.no", "type": "AAAA", "value": "2606:4700:3032::ac43:cba7" } ], "dnssec_valid": false, "ip": "172.67.203.167", "whois": { "created": "2026-04-17T00:00:00Z", "updated": "2026-04-17T00:00:00Z" } } } ```