# PhishDestroy domain threat record: dynamic-restore.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/dynamic-restore.com/
Machine-readable companion: https://phishdestroy.io/domain/dynamic-restore.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-25 12:08:04 UTC
- Stored record updated: 2026-10-25 15:30:37 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.21.60
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-01-03 09:48:22 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0a82e-5874-7241-ab9e-6a75b8c6338d/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/dynamic-restore.com
- Certificate Transparency search: https://crt.sh/?q=%25.dynamic-restore.com
- Web Archive lookup: https://web.archive.org/web/*/https://dynamic-restore.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added dynamic-restore.com to its internal blocklist on 2026-10-25 as a suspicious domain. The site returned HTTP 403 when fetched directly on that date, while a prior urlscan capture on 2026-09-16 recorded a successful HTTP 200 response. No page title was available, and Google Safe Browsing did not flag the URL.

How the scam works
A domain flagged by many security engines may be used for phishing, malware distribution, or other fraudulent activities, but the available evidence does not confirm any specific technique. The listing reflects a risk assessment based on external detections rather than observed malicious behavior on the captured page.

Evidence
VirusTotal scanned the domain on 2026-10-25 and reported 16 detections from 92 engines, including 14 malicious and 2 suspicious labels from vendors such as BitDefender, ESET and Forcepoint ThreatSeeker. Google Safe Browsing checked on the same day and returned no warning. PhishDestroy’s internal blocklist marks the domain as blocked, while external blocklists reported zero hits. OTX listed one pulse referencing the domain. urlscan.io captured the site on 2026-09-16; its machine‑learning engine scored it 93 and marked it malicious, but the overall verdict was non‑malicious. Cloudflare Radar on 2026-10-25 flagged the domain as phishing and malware.

Infrastructure
The domain was registered on 2026-01-03 through Dynadot Inc and was 295 days old at first sighting. It was observed to resolve to Cloudflare IPs 104.21.21.60 and 172.67.196.196, with the network identified as Cloudflare, Inc. in Canada. TLS was issued by Google Trust Services on 2026-08-27, valid until 2026-11-25, covering the apex and subdomains. Nameservers were dylan.ns.cloudflare.com and stella.ns.cloudflare.com; DNSSEC was not enabled.

What to do
Visitors should avoid entering credentials or downloading files from this domain and should change any passwords used there. Security teams can block the exact hostname, monitor DNS queries for the domain, and add it to internal threat feeds.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0a82e-5874-7241-ab9e-6a75b8c6338d/
Cloudflare Radar report: https://radar.cloudflare.com/scan/bd4579b9-d253-47a7-890e-625bef289995
Stored capture screenshot: https://urlscan.io/screenshots/01a0a82e-5874-7241-ab9e-6a75b8c6338d.png
Cloudflare Radar screenshot (2026-10-25T12:11:15Z): https://screenshots.phishdestroy.io/cf/bd4579b9-d253-47a7-890e-625bef289995.png
VirusTotal report: https://www.virustotal.com/gui/domain/dynamic-restore.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=dynamic-restore.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 12:13:48 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0a82e-5874-7241-ab9e-6a75b8c6338d.png
  Captured: 2026-10-25 12:08:04 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0a82e-5874-7241-ab9e-6a75b8c6338d.png
  Source report: https://urlscan.io/result/01a0a82e-5874-7241-ab9e-6a75b8c6338d/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/bd4579b9-d253-47a7-890e-625bef289995.png
  Captured: 2026-10-25 12:11:15 UTC
  Source report: https://radar.cloudflare.com/scan/bd4579b9-d253-47a7-890e-625bef289995
  SHA-256: c92527a69aa3fcebe780fb0d114e03d6a626390234da8bc5086dbbd206c8b559

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T12:13:09Z",
        "uuid": "01a0a82e-5874-7241-ab9e-6a75b8c6338d",
        "scanned_at": "2026-09-16T03:06:52Z",
        "final_url": "https://dynamic-restore.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://dynamic-restore.com/",
                "from": "http://dynamic-restore.com/",
                "status": 307
            }
        ],
        "ip": "172.67.196.196",
        "ips": [
            "172.67.196.196"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "88a835f302981c38baf59a4472b712362d9204f48a27c9e58c1092f64cd61f14",
        "script_hashes": [
            "186af7895e9e9866016a6c7d0c14773bdb57a84131ec8dc179ad00c29261d416",
            "f5c0d7df3136feeaccc8d3a35b4e1e1f6740364fed66d7e5a7e5473adf7ae997",
            "7287415f1722a1f1bec115343804dd3fa9edb7aaf615c18dd97e7fc5963d7ca8",
            "6974c99b4065682ccc547b516eb5c79dd91849622b204fee9ac4543a21a2d377",
            "00fd6d6e785a245fe3bb77e4e994bbd02f829731baf886ddbed4c1554d738e7c",
            "00c9e8f1f5e39c8cf3f1f1f0f933c3b9a44483bf8b42162e11634a55a3594316",
            "bf84c654783f6f7197eb5d3d7b6a25beff0f636fdf2254bf2b119f84eff2f5c1",
            "dd2210f66003c7d35be6a10eead90ff0e052b48bdc23aef65de4bb1ad117ad45"
        ],
        "globals": [
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_SSR_SETTERS__",
            "__buildAssetsURL",
            "__publicAssetsURL",
            "$fetch",
            "global",
            "__unctx__",
            "__unctx_async_handlers__",
            "__VUE__",
            "useNuxtApp"
        ],
        "cookies": [
            "surfer_uuid"
        ],
        "tls": {
            "san": [
                "dynamic-restore.com",
                "*.dynamic-restore.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "dynamic-restore.com",
            "protocol": "QUIC",
            "valid_to": "2026-11-25T15:39:06Z",
            "valid_from": "2026-08-27T14:39:26Z"
        },
        "domain_age_days": 255,
        "apex_age_days": 255,
        "tls_age_days": 19,
        "tls_valid_days": 90,
        "requests": 13,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 93,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T12:13:11Z",
        "uuid": "bd4579b9-d253-47a7-890e-625bef289995",
        "scanned_at": "2026-10-25T12:11:15Z",
        "final_url": "https://dynamic-restore.com/",
        "status": 200,
        "history": [
            {
                "url": "https://dynamic-restore.com/",
                "status": 200
            }
        ],
        "dom_hash": "6f581d7a067e4f4d9088edf3075d62ff1b2167feb916c0b5981aeb51a3f34d74",
        "doc_hash": "fe2edd29ce9c99b47944c91aac57625706c7cdf194d8abb1a6c262ff9e734337",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "dynamic-restore.com",
                "type": "A",
                "value": "104.21.21.60"
            },
            {
                "name": "dynamic-restore.com",
                "type": "A",
                "value": "172.67.196.196"
            },
            {
                "name": "dynamic-restore.com",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:c4c4"
            },
            {
                "name": "dynamic-restore.com",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:153c"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.21.60",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-01-03T10:48:22Z",
            "updated": "2026-01-03T10:48:33Z",
            "expires": "2027-01-03T10:48:22Z",
            "nameservers": [
                "dylan.ns.cloudflare.com",
                "stella.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T12:10:22Z",
        "analysis_at": "2026-10-25T02:19:44Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 14,
            "suspicious": 2,
            "undetected": 32
        },
        "detections": {
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "created": "2026-01-03T00:00:00Z",
        "updated": "2026-01-04T00:00:00Z",
        "first_seen": "2026-01-03T11:03:06Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dylan.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:153c"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "dylan.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:c4c4"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.196.196"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.21.60"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "stella.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-25T02:25:01Z",
        "jarm": "27d40d40d00040d1dc27d40d27d40d5fb4c89fe3813d172ffb53f84a68f750",
        "cert": {
            "san": [
                "dynamic-restore.com",
                "*.dynamic-restore.com"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "8f46257266278ca31353b461c4c1764",
            "sha256": "8c83635850586abe98ddd559a84914b04bfb32aea7ba6d11fac4f550557b4cd7",
            "subject": "dynamic-restore.com",
            "valid_to": "2026-11-25T15:39:06Z",
            "valid_from": "2026-08-27T14:39:26Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-01-03T10:48:22Z",
                "last changed": "2026-01-04T11:28:38Z",
                "registration": "2026-01-03T10:48:22Z",
                "registrar expiration": "2027-01-03T10:48:22Z",
                "last update of RDAP database": "2026-10-16T06:41:05Z"
            },
            "registrar": "DYNADOT LLC",
            "registrar_iana_id": "472"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T12:13:23Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "dynamic-restore.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-25T12:10:36Z",
            "first": "2026-10-12T04:50:47Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.08,
            "avg_page_bytes": 1952
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "social_tags": {
            "themeColor": "#ffffff"
        },
        "trackers": {
            "requests": 11
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 9,
                "tls": 37,
                "wait": 156,
                "connect": 10,
                "download": 5
            },
            "response_ms": 217
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "ECDHE-ECDSA-AES128-GCM-SHA256",
            "protocol": "TLSv1.2",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 4147,
            "co2_grams": 0.0002,
            "cleaner_than": 91
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.35.187",
                    "host": "dylan.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.34.154",
                    "host": "stella.ns.cloudflare.com"
                }
            ],
            "zone": "dynamic-restore.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "surfer_uuid"
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3035::6815:153c",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "dynamic-restore.com"
        },
        "dns": {
            "A": [
                "172.67.196.196",
                "104.21.21.60"
            ],
            "NS": [
                "stella.ns.cloudflare.com",
                "dylan.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"dylan.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415116645, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3035::6815:153c",
                "2606:4700:3032::ac43:c4c4"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3035::6815:153c",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://dynamic-restore.com"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-01-03T10:48:22Z",
            "updated": "2026-01-03T10:48:33Z",
            "expires": "2027-01-03T10:48:22Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "dylan.ns.cloudflare.com",
                "stella.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```