# PhishDestroy domain threat record: earnrespr.mittencactus.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/earnrespr.mittencactus.com/ Machine-readable companion: https://phishdestroy.io/domain/earnrespr.mittencactus.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-25 14:24:09 UTC - Last availability or vendor check: 2026-10-25 23:00:30 UTC - Stored record updated: 2026-10-25 23:22:26 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 2.59.170.20 - Registrar in stored WHOIS data: NameCheap, Inc. - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2025-10-23 22:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a022e0-0715-713d-8ed5-da37f74f6df2/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/earnrespr.mittencactus.com - Certificate Transparency search: https://crt.sh/?q=%25.earnrespr.mittencactus.com - Web Archive lookup: https://web.archive.org/web/*/https://earnrespr.mittencactus.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added earnrespr.mittencactus.com to its blocklist on 2026-10-25 based on a trusted report. The initial AI assessment on the same day could not determine malicious behavior because the page provided insufficient content, and an HTTP request on 2026-10-25 returned a 200 status for the exact subdomain. Google Safe Browsing checked the URL on 2026-10-25 and reported no flag. How the scam works The domain is flagged as suspicious but no concrete fraud scheme was observed; the evidence only indicates a potential risk that the site could be used for phishing, malware delivery, or other fraudulent activity. Because the page content was minimal, PhishDestroy cannot attribute a specific mechanism to this listing. Evidence VirusTotal analysis on 2026-10-23 recorded one malicious detection out of 92 engines, with SOCRadar labeling the domain as phishing. Cloudflare Radar scanned the site on 2026-10-25 and returned a malicious verdict categorized as malware. URLScan captured a screenshot on 2026-08-21 and reported the page as clean, while OTX showed zero pulses as of 2026-10-25. PhishDestroy’s internal blocklist includes the domain, and external blocklists checked on 2026-10-25 returned no entries. Infrastructure The recorded DNS query on 2026-10-25 returned two IPv4 addresses, 2.59.170.20 and 104.219.250.37, which were listed under the Web-hosting.com network in the United States. Additional DNS records observed on the same date included Cloudflare IPs 104.21.77.36 and 172.67.204.4, and the authoritative nameservers were ns1.lander.d.parity.domains and ns2.lander.d.parity.domains. The TLS certificate retrieved on 2026-10-14 was issued by Google Trust Services for mittencactus.com and its wildcard, valid until 2027-01-12, and DNSSEC validation was not present. What to do Visitors should avoid entering credentials or downloading files from the site and monitor their devices for unexpected behavior; password changes are only necessary if any data was submitted. Defenders should add the domain to blocklists, monitor DNS queries for the recorded IPs, and review access logs for connections to this exact address. Use the captured scans for deeper forensic analysis if further investigation is required. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a022e0-0715-713d-8ed5-da37f74f6df2/ Cloudflare Radar report: https://radar.cloudflare.com/scan/921a7db4-461c-4654-9688-98dcac1d09ff Stored capture screenshot: https://urlscan.io/screenshots/01a022e0-0715-713d-8ed5-da37f74f6df2.png Cloudflare Radar screenshot (2026-10-25T14:26:16Z): https://screenshots.phishdestroy.io/cf/921a7db4-461c-4654-9688-98dcac1d09ff.png URLScan screenshot (2026-08-11T14:09:10Z): https://screenshots.phishdestroy.io/us/019ff127-c878-7550-a5a6-07dda9d6ecfd.png URLScan capture report: https://urlscan.io/result/019ff127-c878-7550-a5a6-07dda9d6ecfd/ URLScan screenshot (2026-08-20T18:15:16Z): https://screenshots.phishdestroy.io/us/01a02062-5678-7557-a85e-f2df7d8d9fe4.png URLScan capture report: https://urlscan.io/result/01a02062-5678-7557-a85e-f2df7d8d9fe4/ VirusTotal report: https://www.virustotal.com/gui/domain/earnrespr.mittencactus.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=earnrespr.mittencactus.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 14:28:16 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a022e0-0715-713d-8ed5-da37f74f6df2.png Captured: 2026-10-25 14:24:09 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a022e0-0715-713d-8ed5-da37f74f6df2.png Source report: https://urlscan.io/result/01a022e0-0715-713d-8ed5-da37f74f6df2/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/921a7db4-461c-4654-9688-98dcac1d09ff.png Captured: 2026-10-25 14:26:16 UTC Source report: https://radar.cloudflare.com/scan/921a7db4-461c-4654-9688-98dcac1d09ff SHA-256: a5db7ab655d3900bfb2bf44f8483ca7ce06fc6f795376f14b777be50f1f0af62 - URLScan · 2026-08-11: https://screenshots.phishdestroy.io/us/019ff127-c878-7550-a5a6-07dda9d6ecfd.png Captured: 2026-08-11 14:09:10 UTC Source report: https://urlscan.io/result/019ff127-c878-7550-a5a6-07dda9d6ecfd/ SHA-256: 9d6033fea6cf942e6efa5f6bba7d3bdf0b912e081993190a40db9c6701213140 - URLScan · 2026-08-20: https://screenshots.phishdestroy.io/us/01a02062-5678-7557-a85e-f2df7d8d9fe4.png Captured: 2026-08-20 18:15:16 UTC Source report: https://urlscan.io/result/01a02062-5678-7557-a85e-f2df7d8d9fe4/ SHA-256: 9d6033fea6cf942e6efa5f6bba7d3bdf0b912e081993190a40db9c6701213140 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T15:11:16Z", "uuid": "01a022e0-0715-713d-8ed5-da37f74f6df2", "scanned_at": "2026-08-21T05:51:47Z", "final_url": "https://earnrespr.mittencactus.com/", "status": 404, "redirected": "https-only", "redirects": [ { "to": "https://earnrespr.mittencactus.com/", "from": "http://earnrespr.mittencactus.com/", "status": 307 } ], "ip": "172.67.204.4", "ips": [ "172.67.204.4" ], "asns": [ "13335" ], "doc_hash": "ecf14b9ebe7061cddc7e2097a66c90692cc9c1d70d96b5f7ebdd14a0dbb61f54", "tls": { "san": [ "mittencactus.com", "*.mittencactus.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "mittencactus.com", "protocol": "QUIC", "valid_to": "2026-11-14T01:58:25Z", "valid_from": "2026-08-16T00:59:37Z" }, "domain_age_days": 300, "apex_age_days": 300, "tls_age_days": 5, "tls_valid_days": 90, "requests": 2, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 12, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T14:27:23Z", "uuid": "921a7db4-461c-4654-9688-98dcac1d09ff", "scanned_at": "2026-10-25T14:26:16Z", "final_url": "https://earnrespr.mittencactus.com/", "history": [ { "url": "https://earnrespr.mittencactus.com/", "status": 0 } ], "dom_hash": "94bfc7c24186e5b245b5675859fb84b248547086370961e5637590177432b219", "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "earnrespr.mittencactus.com", "type": "A", "value": "2.59.170.20" }, { "name": "earnrespr.mittencactus.com", "type": "A", "value": "104.219.250.37" } ], "dnssec_valid": false, "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "NameCheap, Inc.", "created": "2025-10-24T10:44:30Z", "updated": "2026-10-25T08:14:58Z", "expires": "2027-10-24T10:44:30Z", "nameservers": [ "dns101.registrar-servers.com", "dns102.registrar-servers.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T14:25:31Z", "analysis_at": "2026-10-23T19:29:00Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 1, "suspicious": 0, "undetected": 36 }, "detections": { "SOCRadar": "phishing" }, "reputation": 0, "created": "2025-10-24T00:00:00Z", "updated": "2025-10-24T00:00:00Z", "first_seen": "2025-10-24T13:45:42Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::ac43:cc04" }, { "ttl": 300, "type": "A", "value": "104.21.77.36" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::6815:4d24" }, { "ttl": 300, "type": "A", "value": "172.67.204.4" } ], "dns_at": "2026-10-23T19:32:28Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "mittencactus.com", "*.mittencactus.com" ], "issuer": "Google Trust Services / WE1", "serial": "f7c5acafe1e7213d0eae6c6af88277c6", "sha256": "548a7a9199bf83b8484827650ee1df1b80dee3420f58ed91e7355c6e1d1efe53", "subject": "mittencactus.com", "valid_to": "2027-01-12T03:30:13Z", "valid_from": "2026-10-14T02:31:24Z" }, "whois": [] }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T14:27:45Z", "caa_records": { "domain": "earnrespr.mittencactus.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "ports": { "open": [ 80, 443 ] }, "dns_server": { "ns": [ { "ip": "192.236.150.131", "host": "ns1.lander.d.parity.domains" }, { "ip": "162.222.205.190", "host": "ns2.lander.d.parity.domains" } ], "zone": "earnrespr.mittencactus.com" }, "location": { "ip": "104.219.250.37", "asn": "22612", "org": "Web-hosting.com", "city": "Phoenix", "country": "US" }, "dns": { "A": [ "104.219.250.37", "2.59.170.20" ], "NS": [ "ns2.lander.d.parity.domains", "ns1.lander.d.parity.domains" ], "SOA": "{\"nsname\": \"ns1.lander.d.parity.domains\", \"hostmaster\": \"hostmaster.lander.d.parity.domains\", \"serial\": 8, \"refresh\": 7200, \"retry\": 3600, \"expire\": 1209600, \"minttl\": 60}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "get_ip": { "ip": "2.59.170.20", "family": 4 }, "whois": { "registrar": "NameCheap, Inc.", "created": "2025-10-24T10:44:30Z", "updated": "2026-10-25T08:14:58Z", "expires": "2027-10-24T10:44:30Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "dns101.registrar-servers.com", "dns102.registrar-servers.com" ] } } } ```