# PhishDestroy domain threat record: firehoussub.delivery Content language: English Canonical HTML report: https://phishdestroy.io/domain/firehoussub.delivery/ Machine-readable companion: https://phishdestroy.io/domain/firehoussub.delivery/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-24 08:48:13 UTC - Last availability or vendor check: 2026-10-24 11:13:50 UTC - Stored record updated: 2026-10-24 11:13:50 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 172.67.186.222 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date (registry RDAP, firehoussub.delivery): 2026-09-14 14:18:06 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16d1d-74b1-77cb-b913-977f550a003d/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/firehoussub.delivery - Certificate Transparency search: https://crt.sh/?q=%25.firehoussub.delivery - Web Archive lookup: https://web.archive.org/web/*/https://firehoussub.delivery/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI assigned a malicious verdict to firehoussub.delivery, citing a high confidence AI‑phishing signal combined with the domain’s 39‑day age. The domain was first observed by PhishDestroy on 2026-10-24, and the recorded page title “Firehouse Subs” suggests an attempt to impersonate the restaurant brand. How the scam works Attackers register short‑lived domains that mimic a well‑known brand, replicate its logo or wording, and host a fake login or data‑capture page. Victims who trust the familiar branding may enter credentials or personal information, which the attacker can later reuse on the legitimate service. Evidence VirusTotal scanned the domain on 2026-09-17 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked the URL on 2026-10-24 and did not flag it. urlscan.io captured the site on 2026-10-24; its overall verdict was clean, but its machine‑learning engine assigned a malicious tag with a score of 88. PhishDestroy’s internal blocklist marks the domain as malicious, while external blocklists and OTX showed no entries on the same date. Infrastructure firehoussub.delivery was registered on 2026-09-14 through Dynadot Inc, giving it a 39‑day age at first sighting. The site is served via Cloudflare’s network, with recorded IP addresses 104.21.68.52 and 172.67.186.222, and uses a Let’s Encrypt TLS certificate valid until 2026-12-13. What to do Users should not submit any credentials on this site; if they have already done so, they should change passwords on the legitimate Firehouse Subs accounts and monitor for unauthorized activity. Defenders should block the exact domain firehoussub.delivery at network perimeters and watch for similarly‑named, newly‑registered domains that reference the Firehouse Subs brand. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16c4f-470d-7519-b17d-df455a7d2a30/ Cloudflare Radar report: https://radar.cloudflare.com/scan/45715dbf-eb14-4ab3-b35c-4abb5ffaaab6 Stored capture screenshot: https://urlscan.io/screenshots/01a16c4f-470d-7519-b17d-df455a7d2a30.png Cloudflare Radar screenshot (2026-10-24T08:50:06Z): https://screenshots.phishdestroy.io/cf/45715dbf-eb14-4ab3-b35c-4abb5ffaaab6.png URLScan screenshot (2026-09-14T18:39:34Z): https://screenshots.phishdestroy.io/us/01a0a137-7116-728a-9cb4-87087277d430.png URLScan capture report: https://urlscan.io/result/01a0a137-7116-728a-9cb4-87087277d430/ URLScan screenshot (2026-09-17T09:51:34Z): https://screenshots.phishdestroy.io/us/01a0aec7-221e-702c-a36b-f897d963e90e.png URLScan capture report: https://urlscan.io/result/01a0aec7-221e-702c-a36b-f897d963e90e/ URLScan screenshot (2026-09-20T12:44:00Z): https://screenshots.phishdestroy.io/us/01a0bed7-f535-77f8-b55b-904c64c44c40.png URLScan capture report: https://urlscan.io/result/01a0bed7-f535-77f8-b55b-904c64c44c40/ URLScan screenshot (2026-10-11T11:50:10Z): https://screenshots.phishdestroy.io/us/01a12acc-5802-75ae-b258-196de43470fc.png URLScan capture report: https://urlscan.io/result/01a12acc-5802-75ae-b258-196de43470fc/ URLScan screenshot (2026-10-14T23:24:35Z): https://screenshots.phishdestroy.io/us/01a13cbb-3566-7348-a7b7-1f7da187db7b.png URLScan capture report: https://urlscan.io/result/01a13cbb-3566-7348-a7b7-1f7da187db7b/ URLScan screenshot (2026-10-24T08:49:52Z): https://screenshots.phishdestroy.io/us/01a16d19-f6da-75eb-a648-c5c8afd89a9a.png URLScan capture report: https://urlscan.io/result/01a16d19-f6da-75eb-a648-c5c8afd89a9a/ VirusTotal report: https://www.virustotal.com/gui/domain/firehoussub.delivery Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=firehoussub.delivery Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-24 08:51:48 UTC ## Stored page captures - Primary capture: https://i.ibb.co/ccb5P0PX/5495149cefe7.png Captured: 2026-10-24 08:54:53 UTC - URLScan capture 1: https://urlscan.io/screenshots/01a16d1d-74b1-77cb-b913-977f550a003d.png Captured: 2026-10-24 08:54:53 UTC Source report: https://urlscan.io/result/01a16d1d-74b1-77cb-b913-977f550a003d/ - URLScan capture 2: https://screenshots.phishdestroy.io/01a16c4f-470d-7519-b17d-df455a7d2a30.png Captured: 2026-10-24 08:48:13 UTC Source report: https://urlscan.io/result/01a16d1d-74b1-77cb-b913-977f550a003d/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/45715dbf-eb14-4ab3-b35c-4abb5ffaaab6.png Captured: 2026-10-24 08:50:06 UTC Source report: https://radar.cloudflare.com/scan/45715dbf-eb14-4ab3-b35c-4abb5ffaaab6 SHA-256: e474a175f992442a69e502e42d7748076f7b37bd4715cf7c03ed2b7ff55231c3 - URLQuery: https://screenshots.phishdestroy.io/uq/8bd36d3b-3db2-4558-9caa-e967b281b448.png Source report: https://urlquery.net/report/8bd36d3b-3db2-4558-9caa-e967b281b448 SHA-256: 8b5edf4c9063f9ce1d521889f0ebf9f5ef9b31fcd147ce7857f5ba7025b1f7ed - URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a0a137-7116-728a-9cb4-87087277d430.png Captured: 2026-09-14 18:39:34 UTC Source report: https://urlscan.io/result/01a0a137-7116-728a-9cb4-87087277d430/ SHA-256: 2f8d561b58f810f6d9056917c133d351577edcacf0b37654f14c7977e2209ad4 - URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0aec7-221e-702c-a36b-f897d963e90e.png Captured: 2026-09-17 09:51:34 UTC Source report: https://urlscan.io/result/01a0aec7-221e-702c-a36b-f897d963e90e/ SHA-256: 0efd9aff676ae31e2c1a8341f8328ba81ca2c2acea01adf75ce6d223bc77c882 - URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0ce96-ea96-70dc-add3-50944874d253.png Captured: 2026-09-23 14:06:44 UTC Source report: https://urlscan.io/result/01a0ce96-ea96-70dc-add3-50944874d253/ SHA-256: 0efd9aff676ae31e2c1a8341f8328ba81ca2c2acea01adf75ce6d223bc77c882 - URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12acc-5802-75ae-b258-196de43470fc.png Captured: 2026-10-11 11:50:10 UTC Source report: https://urlscan.io/result/01a12acc-5802-75ae-b258-196de43470fc/ SHA-256: 0efd9aff676ae31e2c1a8341f8328ba81ca2c2acea01adf75ce6d223bc77c882 - URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16c4f-470d-7519-b17d-df455a7d2a30.png Captured: 2026-10-24 05:08:33 UTC Source report: https://urlscan.io/result/01a16c4f-470d-7519-b17d-df455a7d2a30/ SHA-256: d39b5f8edc2a9056ccb7429add6a9df513a29ce6bceada60c2df0bbc618f68df - URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16d19-f6da-75eb-a648-c5c8afd89a9a.png Captured: 2026-10-24 08:49:52 UTC Source report: https://urlscan.io/result/01a16d19-f6da-75eb-a648-c5c8afd89a9a/ SHA-256: 2bec7b6d3b3615846643daf759c915daeda37438be4bf4782e6d15a2d517cadc ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-24T10:14:10Z", "uuid": "01a16d1d-74b1-77cb-b913-977f550a003d", "scanned_at": "2026-10-24T08:53:38Z", "final_url": "https://firehoussub.delivery/v2/signin", "status": 200, "ip": "172.67.186.222", "domains": [ "czqk28jt.apicdn.sanity.io", "play.google.com", "cdn.cookielaw.org", "cdn.sanity.io", "analytics.tiktok.com", "app.launchdarkly.com", "www.gstatic.com", "api2.amplitude.com", "cdn0.forter.com", "events.launchdarkly.com", "app-cf.bc0a.com", "28d8e04c2191439e91dc535d1174345b-3e93093bbe14.cdn.forter.com", "api2.branch.io", "www.googletagmanager.com", "ixfd2-api.bc0a.com", "pay.google.com", "connect.facebook.net", "analytics.google.com", "use1-prod-fhs-gateway.rbictg.com", "maps.googleapis.com", "clientstream.launchdarkly.com", "use.fontawesome.com", "sdk.iad-05.braze.com", "cdn6.forter.com", "cdn3.forter.com", "www.facebook.com", "mpc2-prod-29-is5qnl632q-uc.a.run.app", "i.vimeocdn.com", "player.vimeo.com", "stats.g.doubleclick.net" ], "ips": [ "2600:9000:208a:d000:c:c4f8:2a80:93a1", "18.64.211.6", "54.212.138.5", "35.174.189.20", "57.144.248.1", "2600:1900:4240:200::", "54.158.164.13", "34.192.191.43", "157.240.0.6", "2.16.204.213", "172.217.113.4", "34.149.250.58", "151.101.0.217", "162.159.138.60", "2a00:1450:4001:c21::9c" ], "asns": [ "16509", "14618", "32934", "396982", "20940", "15169", "54113", "13335", "6185" ], "countries": [ "US", "DE" ], "link_domains": [ "www.ezcater.com", "firehousesubsfoundation.org", "careers.firehoussub.delivery", "www.franchising.firehoussub.delivery", "www.firehousesubs.com", "www.franchising.firehousesubs.com", "apps.apple.com", "play.google.com", "news.firehousesubs.com", "careers.firehousesubs.com", "www.instagram.com", "www.facebook.com", "www.youtube.com", "twitter.com", "www.onetrust.com" ], "social": [ "https://www.instagram.com/firehousesubs", "https://www.facebook.com/firehousesubs", "https://www.youtube.com/channel/UCUN4J9T7bggwD2MJSj2uJmw", "https://twitter.com/FirehouseSubs" ], "doc_hash": "adbb57b8ebbdd74280f61d0cba6fe0de11934a66b2dd2a626566b72fc9654b03", "script_hashes": [ "5d297c586ca6761849231214edfc02c7a2a422e3e276c95d94806740c941ea21", "a790cc31d6ab27bde243c195ee9530f0d0767dd5d5de7074ea4d6386275a8c6c", "d719d67a17ae602752ddef4d95ae182ddd4ac920d73349eb5d4391e84403e837", "7d0ae0bf27e917c2337f1c51070c90074274e74fb96e8e45602df7f187e2520c", "d761387829020a70fc36b9fe086f1f3a7e6b79b919887b7e996cafa23eef037f", "1d0dcad480eda38b246121e96031e275ab05853fb0100703f2ffe433d17541c1" ], "globals": [ "BEJSSDKObserver", "jsElementReady", "BEJSSDK", "BEIXF", "denylistedDomainsHashedValueListForGpayButtonWithCardInfo", "allowedPaymentMethodsForLoggingAllowlist", "whitelistedDomainsHashedValueListForGpayButtonWithCardInfo", "denylistedMerchantIdsHashedValueListForGpayButtonWithCardInfo", "denylistedMerchentIdsHashedValueListForGpayButtonWithCardInfo", "denylistedMerchantIdsHashedValueListForGpayButtonVariant", "allowlistedMerchantDomainsForBnplDynamicButton", "allowlistedMerchantDomainsForRlmiaDynamicButton", "denylistedMerchantDomainsForPopupModeLoadingScreen", "dynamicGpayButtonVariant", "integratorExperimentIds", "google", "__BUNDLE_START_TIME__", "__DEV__", "process", "__METRO_GLOBAL_PREFIX__", "__r", "__d", "__c", "__registerSegment", "$$require_external", "ErrorUtils", "webpackJsonp", "WEBVIEW", "ApplePayMerchandising", "__webpack_chunk_load__", "__webpack_require__", "REACT_NAVIGATION_DEVTOOLS", "expo", "__react_navigation__elements_contexts", "__loadBundleAsync", "__extends", "__assign", "__rest", "__decorate", "__param" ], "cookies": [ "NID", "_ga", "_ga_MKSH9XMTWP", "__cf_bm", "_ttp", "_tt_enable_cookie", "_fbp", "ttcsid", "ttcsid_CR1PN6BC77U8E82MVRIG", "forterToken", "_dd_s" ], "storage_keys": [ "__storejs__test__", "ab.test", "ab.storage.events.bbca207a-191b-493f-8cad-7a6a4d563b3d", "ab.storage.sessionId.bbca207a-191b-493f-8cad-7a6a4d563b3d", "ab.storage.messagingSessionStart.bbca207a-191b-493f-8cad-7a6a4d563b3d", "ab.storage.deviceId.bbca207a-191b-493f-8cad-7a6a4d563b3d", "ab.storage.lastSdkReq.bbca207a-191b-493f-8cad-7a6a4d563b3d", "ab.storage.lastReqToEndpoint.bbca207a-191b-493f-8cad-7a6a4d563b3d", "RBI::LAUNCH_DARKLY_USER_ATTRIBUTES", "ab.storage.attributes.bbca207a-191b-493f-8cad-7a6a4d563b3d", "AMP_TEST", "RBI::ORDER", "RBI::APPLIED_LOYALTY_OFFERS", "RBI::APPLIED_LOYALTY_REWARDS", "RBI::OFFERS_REDEEMED_NO_AUTH" ], "tls": { "san": [ "*.firehoussub.delivery", "firehoussub.delivery" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "firehoussub.delivery", "protocol": "QUIC", "valid_to": "2026-12-13T17:40:45Z", "valid_from": "2026-09-14T17:40:46Z" }, "domain_age_days": 39, "apex_age_days": 39, "tls_age_days": 39, "tls_valid_days": 89, "requests": 135, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 83, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html", "referrer-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-24T08:50:45Z", "uuid": "45715dbf-eb14-4ab3-b35c-4abb5ffaaab6", "scanned_at": "2026-10-24T08:50:06Z", "final_url": "https://firehoussub.delivery/", "status": 200, "history": [ { "url": "https://firehoussub.delivery/", "status": 200 } ], "dom_hash": "3d1088dc8a672e00d742556e9e028c0a5b6aafb090978409c5395398af21d49d", "doc_hash": "48331b3684d7146090a1ff2fa2912e43c6323acd2b236aabdce236ae2830e68a", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "firehoussub.delivery", "type": "A", "value": "104.21.68.52" }, { "name": "firehoussub.delivery", "type": "A", "value": "172.67.186.222" }, { "name": "firehoussub.delivery", "type": "AAAA", "value": "2606:4700:3031::ac43:bade" }, { "name": "firehoussub.delivery", "type": "AAAA", "value": "2606:4700:3030::6815:4434" } ], "dnssec_valid": false, "ip": "104.21.68.52", "whois": { "registrar": "Dynadot Inc", "created": "2026-09-14T14:18:06Z", "updated": "2026-09-19T14:18:59Z", "expires": "2027-09-14T14:18:06Z", "nameservers": [ "jobs.ns.cloudflare.com", "vivienne.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-24T08:50:00Z", "analysis_at": "2026-09-17T12:10:38Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "first_seen": "2026-09-14T19:01:40Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "vivienne.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "jobs.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.186.222" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "jobs.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::ac43:bade" }, { "ttl": 300, "type": "A", "value": "104.21.68.52" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::6815:4434" } ], "dns_at": "2026-09-17T12:15:08Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.firehoussub.delivery", "firehoussub.delivery" ], "issuer": "Let's Encrypt / YE2", "serial": "63858eae44adc5394c9e68f2496cf5734bd", "sha256": "1e3a39cc72d701b84485e2afc68fa85662a6c791d0600130da84f5dabba41f11", "subject": "firehoussub.delivery", "valid_to": "2026-12-13T17:40:45Z", "valid_from": "2026-09-14T17:40:46Z" }, "rdap": { "status": [ "client transfer prohibited", "add period" ], "events": { "expiration": "2027-09-14T14:18:06Z", "last changed": "2026-09-14T18:30:11Z", "registration": "2026-09-14T14:18:06Z", "last update of RDAP database": "2026-09-14T19:01:40Z" }, "registrar": "Dynadot Inc", "registrar_iana_id": "472" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-24T08:51:06Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "firehoussub.delivery" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-24T08:49:15Z", "first": "2026-09-14T21:59:14Z", "changes": 2, "days_archived": 3, "scans_per_day": 0.05, "avg_page_bytes": 3895 }, "sitemap": { "present": true, "url_count": 1322 }, "social_tags": { "title": "Firehouse Subs", "themeColor": "#ffffff" }, "trackers": { "requests": 11, "trackers": [ { "name": "Google", "company": "Google", "country": "US", "category": "Advertising", "requests": 2 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "Apple Pay", "company": "Apple", "country": "US", "category": "Utilities", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://cdn.bc0a.com/autopilot/f00000000030803/autopilot_sdk.js", "https://pay.google.com/gp/p/js/pay.js", "https://applepay.cdn-apple.com/jsapi/v1/apple-pay-sdk.js" ], "third_party_scripts": 3 }, "status": { "up": true, "code": 200, "timings": { "dns": 1, "tls": 16, "wait": 410, "connect": 9, "download": 0 }, "response_ms": 436 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 9396, "co2_grams": 0.0003, "cleaner_than": 73 }, "dns_server": { "ns": [ { "ip": "172.64.34.50", "host": "vivienne.ns.cloudflare.com" }, { "ip": "173.245.59.183", "host": "jobs.ns.cloudflare.com" } ], "zone": "firehoussub.delivery" }, "cookies": { "cookies": [ { "name": "NID", "secure": true, "http_only": true, "same_site": "None" } ] }, "location": { "ip": "2606:4700:3031::ac43:bade", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "firehoussub.delivery" }, "dns": { "A": [ "172.67.186.222", "104.21.68.52" ], "NS": [ "jobs.ns.cloudflare.com", "vivienne.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"jobs.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415124401, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3030::6815:4434", "2606:4700:3031::ac43:bade" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "same-origin", "xXSSProtection": "1; mode=block", "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3031::ac43:bade", "family": 6 }, "redirects": { "chain": [ "https://firehoussub.delivery" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html", "referrer-policy": "same-origin" } } } } ```