# PhishDestroy domain threat record: falgoidop.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/falgoidop.com/
Machine-readable companion: https://phishdestroy.io/domain/falgoidop.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-26 02:03:01 UTC
- Stored record updated: 2026-10-26 03:30:23 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.97.1
- Registrar in stored WHOIS data: NameCheap, Inc.
- Registration date in stored WHOIS data: 2026-01-23 09:28:53 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019ff76a-6e0a-73d8-98c7-08f9beaf1bd1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/falgoidop.com
- Certificate Transparency search: https://crt.sh/?q=%25.falgoidop.com
- Web Archive lookup: https://web.archive.org/web/*/https://falgoidop.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added falgoidop.com to its internal blocklist on 2026-10-26 following an intake that cited 14 malicious detections from VirusTotal. The page fetch performed on the same day returned HTTP 503, meaning the site was not serving content at that moment. No page title or visible content was captured, so the assessment relies on external signals rather than observed page behavior.

How the scam works
The detections associated with this domain fall into generic categories such as phishing, fraud and possible malware distribution, as indicated by multiple security vendors. These categories typically involve deceptive pages that lure users into revealing credentials or downloading malicious payloads, but no specific mechanism was observed on falgoidop.com itself. The presence of a DGA tag suggests the domain may be algorithmically generated, a technique often used to evade simple blacklist filters.

Evidence
VirusTotal scanned the domain on 2026-10-25 and reported 14 malicious and 3 suspicious detections from 92 engines, labeling it as phishing, fraud and DGA. Google Safe Browsing checked on 2026-10-26 and did not flag the domain. urlscan.io captured a snapshot on 2026-08-12; its engines gave a clean verdict with an overall score of zero. Cloudflare Radar scanned on 2026-10-26 and marked the domain as malicious under the malware category. OTX listed one pulse referencing the domain as of 2026-10-26. PhishDestroy’s internal blocklist contains the domain, while external blocklists showed no matches except a single block by Cloudflare Family. The page fetch returned HTTP 503 on 2026-10-26.

Infrastructure
The domain was registered with NameCheap on 2026-01-23 and is 201 days old as of the latest check. The domain was observed using Cloudflare nameservers (owen.ns.cloudflare.com, teresa.ns.cloudflare.com) and was recorded pointing to Cloudflare‑served IPs such as 104.21.52.131 and 188.114.96.3/188.114.97.3, with IPv6 addresses in the 2a06:98c1:3120:: range. TLS was provided by a Let's Encrypt certificate valid from 2026-10-21 to 2027-01-19. The scan recorded that Cloudflare’s WAF was active, DNSSEC was not enabled, and the IP address was located in London, United Kingdom (ASN 13335).

What to do
Visitors should avoid entering any credentials, personal data or downloading files from falgoidop.com; if any information was submitted, change related passwords and monitor accounts for suspicious activity. Organizations should block the domain at the DNS or firewall level, log any connections to its IP addresses, and keep the Cloudflare WAF enabled. Since wallet‑related recommendations are not allowed, no specific crypto‑wallet actions are required unless a wallet was directly compromised.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019ff76a-6e0a-73d8-98c7-08f9beaf1bd1/
Cloudflare Radar report: https://radar.cloudflare.com/scan/607f2e51-9857-467c-9fe0-0a206b71d762
Stored capture screenshot: https://urlscan.io/screenshots/019ff76a-6e0a-73d8-98c7-08f9beaf1bd1.png
Cloudflare Radar screenshot (2026-10-26T02:09:56Z): https://screenshots.phishdestroy.io/cf/607f2e51-9857-467c-9fe0-0a206b71d762.png
URLScan screenshot (2026-10-26T02:10:16Z): https://screenshots.phishdestroy.io/us/01a175f8-9193-71e9-a221-e0519251d7e0.png
URLScan capture report: https://urlscan.io/result/01a175f8-9193-71e9-a221-e0519251d7e0/
VirusTotal report: https://www.virustotal.com/gui/domain/falgoidop.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=falgoidop.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 02:14:06 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019ff76a-6e0a-73d8-98c7-08f9beaf1bd1.png
  Captured: 2026-10-26 02:03:01 UTC
- URLScan capture: https://screenshots.phishdestroy.io/019ff76a-6e0a-73d8-98c7-08f9beaf1bd1.png
  Source report: https://urlscan.io/result/019ff76a-6e0a-73d8-98c7-08f9beaf1bd1/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/607f2e51-9857-467c-9fe0-0a206b71d762.png
  Captured: 2026-10-26 02:09:56 UTC
  Source report: https://radar.cloudflare.com/scan/607f2e51-9857-467c-9fe0-0a206b71d762
  SHA-256: 86eb76763c78662ace892171d266ba56f4a339ed0730a20af5e0a3d2b0771a2e
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a175f8-9193-71e9-a221-e0519251d7e0.png
  Captured: 2026-10-26 02:10:16 UTC
  Source report: https://urlscan.io/result/01a175f8-9193-71e9-a221-e0519251d7e0/
  SHA-256: 589291a7e8ee9ff9830ea4be818fa8290d422509ede8798fab551b65207bea17

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T02:08:47Z",
        "uuid": "019ff76a-6e0a-73d8-98c7-08f9beaf1bd1",
        "scanned_at": "2026-08-12T19:19:56Z",
        "final_url": "https://falgoidop.com/",
        "status": 503,
        "ip": "104.21.52.131",
        "ips": [
            "104.21.52.131"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "6447a2882c4f20346b7b0f041d50d090d7c9aed4620dae267b56456686b11b3d",
        "globals": [
            "oncommand",
            "onanimationcancel",
            "fence",
            "onscrollsnapchange",
            "onscrollsnapchanging",
            "ongamepadconnected",
            "ongamepaddisconnected"
        ],
        "tls": {
            "san": [
                "*.falgoidop.com",
                "falgoidop.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "falgoidop.com",
            "protocol": "QUIC",
            "valid_to": "2026-09-23T08:15:36Z",
            "valid_from": "2026-06-25T08:15:37Z"
        },
        "domain_age_days": 201,
        "apex_age_days": 201,
        "tls_age_days": 48,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -3,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T02:13:40Z",
        "uuid": "607f2e51-9857-467c-9fe0-0a206b71d762",
        "scanned_at": "2026-10-26T02:09:56Z",
        "final_url": "https://falgoidop.com/",
        "status": 503,
        "history": [
            {
                "url": "https://falgoidop.com/",
                "status": 503
            }
        ],
        "dom_hash": "a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e",
        "doc_hash": "6447a2882c4f20346b7b0f041d50d090d7c9aed4620dae267b56456686b11b3d",
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "falgoidop.com",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "falgoidop.com",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "falgoidop.com",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            },
            {
                "name": "falgoidop.com",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.97.0",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-01-23T10:28:53Z",
            "updated": "2026-02-27T10:40:55Z",
            "expires": "2027-01-23T10:28:53Z",
            "nameservers": [
                "owen.ns.cloudflare.com",
                "teresa.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T02:08:22Z",
        "analysis_at": "2026-10-24T23:46:43Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 14,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "Sophos": "phishing and fraud",
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "created": "2026-01-23T00:00:00Z",
        "updated": "2026-01-23T00:00:00Z",
        "first_seen": "2026-01-23T10:48:16Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "teresa.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:c78b"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "owen.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.199.139"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "owen.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.52.131"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:3483"
            }
        ],
        "dns_at": "2026-10-24T23:47:21Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.falgoidop.com",
                "falgoidop.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "65e0d497a997a3be5e8c4aa2a576c7865e4",
            "sha256": "5d7d08c4ad92f64160c7a1bbcf0b6c44d275bfe8b32f5d749d8e90e2c05a2e8d",
            "subject": "falgoidop.com",
            "valid_to": "2027-01-19T06:56:52Z",
            "valid_from": "2026-10-21T06:56:53Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "client transfer prohibited",
                "add period"
            ],
            "events": {
                "registration": "2026-01-23T10:28:53Z",
                "registrar expiration": "2027-01-23T10:28:53Z",
                "last update of RDAP database": "2026-10-24T23:47:11Z"
            },
            "registrar": "NAMECHEAP INC",
            "registrar_iana_id": "1068"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T02:13:49Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "falgoidop.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.216",
                    "host": "teresa.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.193.219",
                    "host": "owen.ns.cloudflare.com"
                }
            ],
            "zone": "falgoidop.com"
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "falgoidop.com"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "teresa.ns.cloudflare.com",
                "owen.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"owen.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418055032, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-01-23T10:28:53Z",
            "updated": "2026-02-27T10:40:55Z",
            "expires": "2027-01-23T10:28:53Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "owen.ns.cloudflare.com",
                "teresa.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```