# PhishDestroy domain threat record: duralexfr.email Content language: English Canonical HTML report: https://phishdestroy.io/domain/duralexfr.email/ Machine-readable companion: https://phishdestroy.io/domain/duralexfr.email/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 12:06:48 UTC - Last availability or vendor check: 2026-10-25 12:17:10 UTC - Stored record updated: 2026-10-25 13:45:07 UTC - VirusTotal detections in the stored snapshot: 18/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 104.21.95.94 - Registrar in stored WHOIS data: Sav.com, LLC - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-06-02 11:24:23 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a172fc-e35d-7059-a38b-2f24ebcc8716/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/duralexfr.email - Certificate Transparency search: https://crt.sh/?q=%25.duralexfr.email - Web Archive lookup: https://web.archive.org/web/*/https://duralexfr.email/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added duralexfr.email to its internal blocklist on 2026-10-25. A snapshot on that date recorded the page title “Vaisselle, verrerie et art de la table – Boutique Duralex®” and an HTTP 200 response. The intake rule accepted the domain based on its 144-day age and a trusted auto rule. How the scam works The listing and detections do not establish a specific mechanism. Detections commonly label such pages as phishing because attackers often mimic brands to deceive visitors, but no credential-harvesting form or malicious code was observed in the captured snapshot. Evidence VirusTotal analysis on 2026-10-19 reported 18 detections from 92 engines, with 14 malicious and 4 suspicious labels from vendors including BitDefender, ESET and Forcepoint. Google Safe Browsing checked on 2026-10-25 returned no flag. urlscan.io capture on 2026-10-25 gave a malicious verdict, categorizing the page as phishing and labeling the brand as a fake shop. OTX listed three pulses referencing the domain as of 2026-10-25. PhishDestroy’s internal blocklist marked the domain as malicious on 2026-10-25, while external blocklists returned zero hits on the same day. Infrastructure The domain was registered on 2026-06-02 through Sav.com, LLC, giving it an age of 144 days at the time of observation. DNS records captured on 2026-10-25 listed A addresses 104.21.95.94 and 172.67.144.21 and AAAA addresses 2606:4700:3031::6815:5f5e and 2606:4700:3032::ac43:9015. The TLS certificate observed was issued by Google Trust Services / WE1, valid from 2026-09-28 to 2026-12-27. The response headers indicated the site was behind Cloudflare, which presented a WAF. What to do Do not enter login, payment or personal information on this site; if any such data was submitted, change the associated passwords immediately. Organizations should block duralexfr.email at firewalls or proxies and review web access logs for visits to the recorded IP addresses. No wallet-related remediation is required because wallet recommendations are disabled for this domain. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a172fc-e35d-7059-a38b-2f24ebcc8716/ Cloudflare Radar report: https://radar.cloudflare.com/scan/7b2df1fc-f802-4318-8487-3654a21dd3bb Stored capture screenshot: https://i.ibb.co/HTC7qGkW/160097bbda64.png Cloudflare Radar screenshot (2026-10-25T12:11:39Z): https://screenshots.phishdestroy.io/cf/7b2df1fc-f802-4318-8487-3654a21dd3bb.png VirusTotal report: https://www.virustotal.com/gui/domain/duralexfr.email Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=duralexfr.email Archived copy: https://web.archive.org/web/20261025120731/https://duralexfr.email/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 12:44:16 UTC ## Stored page captures - Primary capture: https://i.ibb.co/HTC7qGkW/160097bbda64.png Captured: 2026-10-25 12:17:10 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a172fc-e35d-7059-a38b-2f24ebcc8716.png Captured: 2026-10-25 12:17:10 UTC Source report: https://urlscan.io/result/01a172fc-e35d-7059-a38b-2f24ebcc8716/ - URLScan capture 2: https://urlscan.io/screenshots/01a01620-c965-7392-aeb6-ed266998afb0.png Captured: 2026-10-25 12:06:48 UTC Source report: https://urlscan.io/result/01a172fc-e35d-7059-a38b-2f24ebcc8716/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7b2df1fc-f802-4318-8487-3654a21dd3bb.png Captured: 2026-10-25 12:11:39 UTC Source report: https://radar.cloudflare.com/scan/7b2df1fc-f802-4318-8487-3654a21dd3bb SHA-256: 1c5b32c7b65719e10e64995c19fdf84f8e4e1b76c086f23c09e24a43443a8a9d - URLQuery: https://screenshots.phishdestroy.io/uq/b1a22cd4-386d-4b0f-8619-1b4f13547452.png Source report: https://urlquery.net/report/b1a22cd4-386d-4b0f-8619-1b4f13547452 SHA-256: ca571d9075d0ff41fbb6a43a09acb2b0417fa53fc319d9ae01aaba9972fdcec3 - URLScan · 2026-08-18: https://screenshots.phishdestroy.io/us/01a01620-c965-7392-aeb6-ed266998afb0.png Captured: 2026-08-18 18:27:28 UTC Source report: https://urlscan.io/result/01a01620-c965-7392-aeb6-ed266998afb0/ SHA-256: f98f6407bcc29292846b94a5988659e60e3b2d5d5339772d4c82f8faa5909132 - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17303-9523-7754-a396-799cb5ab79c0.png Captured: 2026-10-25 12:23:03 UTC Source report: https://urlscan.io/result/01a17303-9523-7754-a396-799cb5ab79c0/ SHA-256: f98f6407bcc29292846b94a5988659e60e3b2d5d5339772d4c82f8faa5909132 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T12:43:12Z", "uuid": "01a172fc-e35d-7059-a38b-2f24ebcc8716", "scanned_at": "2026-10-25T12:16:10Z", "final_url": "https://duralexfr.email/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://duralexfr.email/", "from": "http://duralexfr.email/", "status": 307 } ], "ip": "2606:4700:3032::ac43:9015", "domains": [ "cdn.ssl-assets-usd.com", "analytics.tiktok.com", "translate-pa.googleapis.com", "www.gstatic.com", "translate.googleapis.com", "connect.facebook.net", "translate.google.com", "www.google.com", "fonts.gstatic.com", "analytics-ipv6.tiktokw.us" ], "ips": [ "142.251.110.95", "172.217.116.4", "2001:4860:4847:400::", "142.251.157.119", "142.251.127.94", "2001:4860:4846:400::", "142.251.14.94", "2a00:1450:4001:c25::5f", "2a00:1450:4001:c21::5e", "2a00:1450:4001:c25::8a", "2a02:26f0:b700:9::210:ce0d", "34.49.63.149", "2.16.204.213", "57.144.244.128", "2606:4700:3032::ac43:9015" ], "asns": [ "15169", "20940", "396982", "32934", "13335" ], "countries": [ "US", "DE" ], "link_domains": [ "translate.google.com" ], "doc_hash": "d5f29fa5864e8c4374e4b9e0183dd71e00cc5dd5a670c9fbbf57ef43f25a92c6", "script_hashes": [ "749fc96cb07b13141550e29be8f92aa34aac2d030310d8ffd53650c840f917a7", "a62af29258561126c7c2449bdd589c0957fa816724f6698eac471bf24b5f5034", "69786343c986e342efc4e2a4cb92106498a2bf9dcde570e14eeb224fd3276b14", "29a17a048536ed2057070a6e9ca51afcb97e53cbe63a27d48688d2fbbc26aa2f", "b3f765e90760aff4067c6e5af670e525e9f80c2509f9abaa6d86fd771f4cccb6", "6536835b1fbf4838f9bdea1d57af68ef7e01beb61741c79da9cfc42ea8f8d787" ], "globals": [ "_duralexfremail_", "_BZFIEFE_", "themeConfig", "shop_theme", "storeConfig", "shop_config", "lang", "shop_lang", "C_SETTINGS", "_GET_C_SETTING_", "oemcart_client_browser", "oemcart_current_template", "oemcart_store_id", "oemcart_user_id", "oemcart_time_zone", "oemcart_page_ca", "oemcart_user_email", "oemcart_pv_id", "oemcart_data_from", "oemcart_user", "oemcart_currency", "oemcart_currency_code", "oemcart_currency_rate", "oemcart_currency_lcoin", "oemcart_currency_rcoin", "oemcart_currency_decimal", "oemcart_base_currency", "oemcart_base_currency_code", "oemcart_base_currency_rate", "oemcart_base_currency_lcoin", "oemcart_base_currency_rcoin", "oemcart_base_currency_decimal", "oemcart_website_domain", "oemcart_real_domain", "oemcart_site_type", "oemcart_client_country", "oemcart_protocal_type", "oemcart_website_language", "oemcart_utm_source", "oemcart_utm_medium" ], "cookies": [ "_fbp", "_baicdd_vid", "_baicdd_cvid", "_baicdd_vs", "utm_source", "utm_medium", "order_utm_history", "landing_page", "_baicdd_ka", "first_http_referer", "first_visit_time", "PHPSESSID", "__cf_bm", "_BZFIEFE_ua", "_BZFIEFE_pu", "_BZFIEFE_tz", "_BZFIEFE_ss", "_BZFIEFE_lang", "_BZFIEFE_vs", "_BZFIEFE_dt" ], "storage_keys": [ "tt_sessionId", "tt_pixel_session_index", "tt_appInfo", "APP_GOOGLETRANSLATE_VISIT_COUNT", "lastExternalReferrer", "lastExternalReferrerTime" ], "tls": { "san": [ "duralexfr.email" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "duralexfr.email", "protocol": "TLS 1.3", "valid_to": "2026-12-27T17:37:16Z", "valid_from": "2026-09-28T16:37:21Z" }, "domain_age_days": 144, "apex_age_days": 144, "tls_age_days": 26, "tls_valid_days": 90, "requests": 76, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "fakeshop" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Fake Shop" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T12:15:27Z", "uuid": "7b2df1fc-f802-4318-8487-3654a21dd3bb", "scanned_at": "2026-10-25T12:11:39Z", "final_url": "https://duralexfr.email/", "status": 200, "history": [ { "url": "https://duralexfr.email/", "status": 200 } ], "dom_hash": "99fbaeb65a075a5a8b164f1b29d6b548639e63c45129e6119f8cc2ad0bc0a843", "doc_hash": "5741c6af93d434b37c26e37f2de86f1ada0c42ed8282f9dcfc79c3b78e31ee4d", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "duralexfr.email", "type": "A", "value": "104.21.95.94" }, { "name": "duralexfr.email", "type": "A", "value": "172.67.144.21" }, { "name": "duralexfr.email", "type": "AAAA", "value": "2606:4700:3031::6815:5f5e" }, { "name": "duralexfr.email", "type": "AAAA", "value": "2606:4700:3032::ac43:9015" } ], "dnssec_valid": false, "ip": "104.21.95.94", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T12:42:26Z", "analysis_at": "2026-10-19T07:46:19Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 14, "suspicious": 4, "undetected": 30 }, "detections": { "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "spam", "Netcraft": "malicious", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Bfore.Ai PreCrime": "malicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2026-06-02T14:03:45Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::6815:5f5e" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::ac43:9015" }, { "ttl": 300, "type": "A", "value": "104.21.95.94" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "cheryl.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "cheryl.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.144.21" }, { "ttl": 21600, "type": "NS", "value": "logan.ns.cloudflare.com" } ], "dns_at": "2026-10-19T07:51:35Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "duralexfr.email" ], "issuer": "Google Trust Services / WE1", "serial": "f4e6a84f8e0d223c0ec146b2cf18889e", "sha256": "83e49115ae7d13b47a138bd346b62833aa175caa45b61e9d39f2d8b5a8f39e47", "subject": "duralexfr.email", "valid_to": "2026-12-27T17:37:16Z", "valid_from": "2026-09-28T16:37:21Z" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-06-02T13:24:23Z", "last changed": "2026-08-01T14:14:07Z", "registration": "2026-06-02T13:24:23Z", "registrar expiration": "2027-06-02T13:24:23Z", "last update of RDAP database": "2026-08-01T14:14:07Z" }, "registrar": "Sav.com, LLC", "registrar_iana_id": "609" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T12:15:49Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "duralexfr.email" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-25T12:07:31Z", "first": "2026-10-25T12:07:31Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 135590 }, "robots_txt": { "agents": [ "*" ], "present": true }, "social_tags": { "ogUrl": "https://duralexfr.email", "title": "Vaisselle, verrerie et art de la table – Boutique Duralex®", "ogType": "website", "ogTitle": "Vaisselle, verrerie et art de la table – Boutique Duralex®", "keywords": "duralex", "ogSiteName": "duralex", "description": "Vaisselle en verre trempé Duralex : robustesse légendaire, design intemporel, fabrication française, durable et livraison rapide depuis la boutique en ligne.", "twitterCard": "summary_large_image", "twitterSite": "https://duralexfr.email", "canonicalUrl": "https://duralexfr.email", "ogDescription": "Vaisselle en verre trempé Duralex : robustesse légendaire, design intemporel, fabrication française, durable et livraison rapide depuis la boutique en ligne." }, "trackers": { "requests": 53, "trackers": [ { "name": "Facebook", "company": "Meta", "country": "US", "category": "Advertising", "requests": 9 }, { "name": "Facebook Custom Audience", "company": "Meta", "country": "US", "category": "Advertising", "requests": 4 }, { "name": "Google Translate", "company": "Google", "country": "US", "category": "Customer Interaction", "requests": 1 }, { "name": "Google APIs", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 3 }, { "name": "Facebook Connect", "company": "Meta", "country": "US", "category": "Site Analytics", "requests": 5 }, { "name": "TikTok Analytics", "company": "ByteDance Inc", "country": "KY", "category": "Site Analytics", "requests": 8 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 22, "tls": 39, "wait": 337, "connect": 20, "download": 31 }, "response_ms": 449 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 663853, "co2_grams": 0.0243, "cleaner_than": 1 }, "dns_server": { "ns": [ { "ip": "172.64.33.198", "host": "logan.ns.cloudflare.com" }, { "ip": "173.245.58.83", "host": "cheryl.ns.cloudflare.com" } ], "zone": "duralexfr.email" }, "cookies": { "cookies": [ { "name": "_fbp", "same_site": "Lax" }, { "name": "_baicdd_vid" }, { "name": "_baicdd_cvid" }, { "name": "_baicdd_vs" }, { "name": "utm_source" }, { "name": "utm_medium" }, { "name": "order_utm_history" }, { "name": "landing_page" }, { "name": "_baicdd_ka" }, { "name": "first_http_referer" }, { "name": "first_visit_time" }, { "name": "PHPSESSID", "session": true }, { "name": "__cf_bm", "secure": true, "http_only": true, "same_site": "None" }, { "name": "_BZFIEFE_ua", "secure": true, "same_site": "None" }, { "name": "_BZFIEFE_pu", "secure": true, "same_site": "None" }, { "name": "_BZFIEFE_tz", "secure": true, "same_site": "None" }, { "name": "_BZFIEFE_ss", "secure": true, "same_site": "None" }, { "name": "_BZFIEFE_lang", "secure": true, "same_site": "None" }, { "name": "_BZFIEFE_vs", "secure": true, "same_site": "None" }, { "name": "_BZFIEFE_dt", "secure": true, "same_site": "None" } ] }, "location": { "ip": "2606:4700:3031::6815:5f5e", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "duralexfr.email" }, "dns": { "A": [ "104.21.95.94", "172.67.144.21" ], "NS": [ "cheryl.ns.cloudflare.com", "logan.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"cheryl.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416376112, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3032::ac43:9015", "2606:4700:3031::6815:5f5e" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3032::ac43:9015", "family": 6 }, "redirects": { "chain": [ "https://duralexfr.email" ] }, "linked_pages": { "internal_count": 81 }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } } } } ```