# PhishDestroy domain threat record: duplicate-disabled-218652.invalid Content language: English Canonical HTML report: https://phishdestroy.io/domain/duplicate-disabled-218652.invalid/ Machine-readable companion: https://phishdestroy.io/domain/duplicate-disabled-218652.invalid/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-06-14 22:27:29 UTC - Last availability or vendor check: 2026-10-21 01:16:23 UTC - Stored record updated: 2026-10-22 14:22:00 UTC - VirusTotal detections in the stored snapshot: 3/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: morpho ## Stored infrastructure - Observed IP address: 138.226.236.69 - Registrar in stored WHOIS data: Immaterialism Limited - Registration date in stored WHOIS data: 2026-05-16 22:07:01 UTC ## Evidence links - URLScan report: https://urlscan.io/result/019e32d7-6f38-773a-b6f7-08135c2c06f3/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/duplicate-disabled-218652.invalid - Certificate Transparency search: https://crt.sh/?q=%25.duplicate-disabled-218652.invalid - Web Archive lookup: https://web.archive.org/web/*/https://duplicate-disabled-218652.invalid/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Analysis of www.h25.io shows the domain was registered on 17 May 2026 through Immaterialism Limited and is hosted on a server owned by Neon Core Network LLC in Belize, resolving to 138.226.236.69. The site is served over HTTPS with a Let’s Encrypt certificate (E8) and uses a typical web stack consisting of Ubuntu, Nginx, PHP, MySQL, WordPress, Bootstrap, Yoast SEO and Underscore.js. The page title returned by the server is “Darknet Markets List – h25.io”, suggesting the site presents a list of illicit marketplaces, a common lure for credential‑ harvesting campaigns. The domain appears on one public security blocklist and has been cited in a single AlienVault OTX pulse. Two of ninety‑two VirusTotal scanners have flagged the host, and Gridinsoft assigns a trust score of 29 / 100. Cloudflare’s “delilah.ns.cloudflare.com” and “dante.ns.cloudflare.com” name servers are in use, and the site is currently reachable with HTTP 200 responses. The domain is actively listed by the PhishDestroy blocklist, confirming ongoing malicious use. While the exact phishing vector has not been observed, the combination of recent registration, low trust score, and detection by multiple threat feeds indicates a high‑risk profile. Defenders should block DNS resolution for www.h25.io, monitor outbound connections to its IP address, and consider sinkholing the domain. Continuous re‑scanning is advised to detect any evolution in payloads or tactics. Analysis generated: 2026-07-12 22:24:41 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/019e32d7-6f38-773a-b6f7-08135c2c06f3.png Captured: 2026-06-14 22:27:29 UTC ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T04:31:34Z", "uuid": "019e32d7-6f38-773a-b6f7-08135c2c06f3", "scanned_at": "2026-05-16T22:10:51Z", "final_url": "https://www.h25.io/dark-web/dark-matter-market/", "status": 200, "ip": "138.226.236.69", "domains": [ "darknetmarketstats.com", "fonts.googleapis.com", "fonts.gstatic.com" ], "ips": [ "142.251.110.94", "188.114.97.3", "142.251.14.95", "2a00:1450:4001:c1f::5f", "138.226.236.69" ], "asns": [ "15169", "13335", "205775" ], "countries": [ "US", "DE", "BZ" ], "link_domains": [ "darkmathiari73grsr6gayiyoid2t6bup5dlxspcdimcqcctiq5leuyd.onion", "darkmath6ewzblvt6pescuhd3b2sf6kz2wuh5n5rihehat7bmpe3reid.onion", "darkmatclpfknfb4yanxzfd2pufyccu6yhsroezu4d7ducsevhuywnyd.onion", "darkmatxprfw2rlowcukyytmj5zppyim5uyrldrc6g427yosrsvei4yd.onion", "darkmatvbyiql5zclyvmzbhro64l3zuvm6pvlos6xk6kf23hsc5xggid.onion", "darkmatnhk3vxuqtci2shcjrqhoy6qe5ipz5ft7byhytnux5pyk77syd.onion", "darkmat4k4yyckj23gg5gpfwbec75r6qr64dj4udqg2dndobvxvrfgid.onion", "darkmat57zgwonzymb6rjd7krcdndsnnrm2br2cyc2frvklrbg7vagqd.onion", "www.getmonero.org", "z.cash", "www.facebook.com", "twitter.com", "www.linkedin.com", "pinterest.com", "t.me", "service.weibo.com", "reddit.com", "www.xing.com", "mastodonshare.com", "bsky.app", "www.threads.net", "darknetking.com", "vaiyo.io", "darknetmarketstats.com", "2bone.com" ], "social": [ "https://www.facebook.com/sharer.php", "https://twitter.com/intent/tweet", "https://t.me/share/url" ], "doc_hash": "43be846e0e1943eef93c3ee27d6f8806a324751afd9f2afc6508a9486d7058f3", "script_hashes": [ "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf", "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89", "3156ac3f8b5c61bf0e9df9e452563b35cdb5fe9f0abbda56d672728fc7119540", "75c672f8bf41a708389bcf0139cb259517f517473576847f7f6c4f981c32c03c", "ef37f3f48f5c5826a55a23e3348a22d153b3f4d47512ceda1659002efc902a0f", "4f1b711a70df30bf8d000f0bca9adc2d3bf6c707ea19a412b463dec92c0d6af1", "8264902649681acfb3cf80fbd4ed16d259a41f7a4177996b3be44ac782b03571", "3e23f2ac4673bb33dc50989788797823bb87cf9f47c91317c4abcf8db38758f3", "3d88ead05c4a6f77ad9bbd1cb0cd94a68cb92e966ea1422e273d92b92a9a8b74", "54c71ddc328a3de8c8a6e2af2d02d850f803eea9872dcafc00e00dd075dbf576" ], "globals": [ "jQuery", "_paq", "sp_eab_ajax", "productQuantity", "rmp_frontend", "rate_my_post", "EvEmitter", "imagesLoaded", "jQueryBridget", "getSize", "matchesSelector", "fizzyUIUtils", "Outlayer", "Isotope", "Masonry", "sydney", "sydneyDomReady", "InfiniteScroll", "wp", "pum_vars", "pum_sub_vars", "pum_popups", "PUM", "pum", "pm_cookie", "pm_cookie_json", "pm_remove_cookie", "PUM_Analytics", "PUM_URLTracking", "ajaxurl", "WP_Statistics_Tracker_Object", "handleWpConsentApiIntegration", "handleRealCookieBannerIntegration", "WpStatisticsUserTracker", "WpStatisticsEventTracker", "_", "_wpUtilSettings", "Picker", "um_common_variables", "UM" ], "cookies": [ "_pk_ref.1.87cc", "_pk_id.1.87cc", "_pk_ses.1.87cc" ], "tls": { "san": [ "www.h25.io" ], "cipher": "AES_256_GCM", "issuer": "E8", "subject": "www.h25.io", "protocol": "TLS 1.3", "valid_to": "2026-06-23T02:44:18Z", "valid_from": "2026-03-25T02:44:19Z" }, "domain_age_days": 2453, "apex_age_days": 2453, "tls_age_days": 52, "tls_valid_days": 89, "requests": 131, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 42, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx/1.24.0 (Ubuntu)", "content-type": "text/html; charset=UTF-8", "permissions-policy": "private-state-token-redemption=(self \"https://www.google.com\" \"https://www.gstatic.com\" \"https://recaptcha.net\" \"https://challenges.cloudflare.com\" \"https://hcaptcha.com\"), private-state-token-issuanc" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T04:46:44Z", "uuid": "1edd205e-1cb2-422a-b24e-f74b184ccc5b", "scanned_at": "2026-05-12T13:34:15Z", "final_url": "https://www.h25.io/", "status": 200, "redirected": "subdomain", "history": [ { "url": "https://h25.io/", "status": 301 }, { "url": "https://www.h25.io/", "status": 200 }, { "url": "https://www.h25.io/", "status": 200 } ], "dom_hash": "cf361f5f0cdebe9742ead614c946c0524de05a7189477382fe8abeb09daca797", "doc_hash": "89976bf4ac43c763cd2f1707ae7637410567ab366545d97399c0447bc78bfc58", "domain_risks": [ "Questionable Activities", "Questionable Content", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "h25.io", "type": "A", "value": "138.226.236.69" }, { "name": "www.h25.io", "type": "A", "value": "138.226.236.69" } ], "dnssec_valid": false, "ip": "138.226.236.69", "whois": { "registrar": "Immaterialism Limited", "created": "2023-10-08T17:00:00Z", "updated": "2025-11-11T17:11:48Z", "expires": "2026-10-08T17:00:00Z", "nameservers": [ "delilah.ns.cloudflare.com", "dante.ns.cloudflare.com" ] } } } ```