# PhishDestroy domain threat record: firehoussuber.delivery Content language: English Canonical HTML report: https://phishdestroy.io/domain/firehoussuber.delivery/ Machine-readable companion: https://phishdestroy.io/domain/firehoussuber.delivery/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-24 08:53:50 UTC - Last availability or vendor check: 2026-10-24 11:13:54 UTC - Stored record updated: 2026-10-24 11:13:54 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 104.21.47.172 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date (registry RDAP, firehoussuber.delivery): 2026-09-14 14:18:06 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16d1f-a86e-70d7-a548-4ef78a347b2b/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/firehoussuber.delivery - Certificate Transparency search: https://crt.sh/?q=%25.firehoussuber.delivery - Web Archive lookup: https://web.archive.org/web/*/https://firehoussuber.delivery/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake system classified firehoussuber.delivery as malicious because an AI model identified a high‑confidence phishing pattern and the domain was only 39 days old. The recorded page title reads “Firehouse Subs” and the page excerpt shows a sign‑in form with a JavaScript‑disabled warning, indicating an attempt to gather login data. The domain was first seen by PhishDestroy on 2026-10-24 and returned an HTTP 200 response on that date. How the scam works In credential‑phishing attacks, attackers register a look‑alike domain, copy the visual branding of a legitimate business, and host a fake sign‑in page that captures usernames and passwords when users submit them. Victims are typically lured by the familiar brand name and may reuse credentials across services, allowing attackers to hijack accounts if the data is harvested. Evidence The intake assessment noted brand impersonation and a sign‑in form as risk signals. VirusTotal scanned the domain on 2026-10-24 and reported 0 malicious detections out of 92 engines. Google Safe Browsing, checked the same day, did not flag the URL. URLScan captured the site on 2026-10-24; its engine tags marked it as potentially malicious (score 80) but the overall verdict was clean. OTX listed three pulses referencing the domain, and PhishDestroy’s internal blocklist contains the domain as of 2026-10-24. Infrastructure The domain was registered on 2026-09-14 through Dynadot Inc, giving it an age of 39 days at first sight. The recorded DNS entries listed Cloudflare‑managed IP addresses 104.21.47.172 and 172.67.171.177, and the network was identified as Cloudflare, Inc. in Canada. TLS is provided by Let’s Encrypt, valid from 2026-09-14 to 2026-12-13. No external blocklists reported the domain. What to do Users who may have entered credentials should change those passwords immediately and enable multi‑factor authentication where possible. Organizations should block firehoussuber.delivery at the network perimeter and review authentication logs for any attempts to use the domain. Since no wallet interactions were detected, no wallet‑specific remediation is required. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16d1f-a86e-70d7-a548-4ef78a347b2b/ Cloudflare Radar report: https://radar.cloudflare.com/scan/e11bf541-486b-4d80-b7bc-7c97a7847f22 URLQuery report: https://urlquery.net/report/d4b28060-1050-4748-85e3-ab7137babe9c Stored capture screenshot: https://i.ibb.co/1YzH1HMB/e368d7f13b11.png Cloudflare Radar screenshot (2026-10-24T08:55:02Z): https://screenshots.phishdestroy.io/cf/e11bf541-486b-4d80-b7bc-7c97a7847f22.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/d4b28060-1050-4748-85e3-ab7137babe9c.png URLScan screenshot (2026-09-14T19:10:37Z): https://screenshots.phishdestroy.io/us/01a0a153-dd10-73e9-b217-c915bb62e12d.png URLScan capture report: https://urlscan.io/result/01a0a153-dd10-73e9-b217-c915bb62e12d/ URLScan screenshot (2026-09-14T19:12:32Z): https://screenshots.phishdestroy.io/us/01a0a155-a1b7-7464-ad92-483f902c5502.png URLScan capture report: https://urlscan.io/result/01a0a155-a1b7-7464-ad92-483f902c5502/ URLScan screenshot (2026-10-11T11:49:50Z): https://screenshots.phishdestroy.io/us/01a12acc-1123-774d-848a-eb8d8dfcfbd4.png URLScan capture report: https://urlscan.io/result/01a12acc-1123-774d-848a-eb8d8dfcfbd4/ URLScan screenshot (2026-10-24T05:08:14Z): https://screenshots.phishdestroy.io/us/01a16c4f-07a8-717f-a00a-22bb14b4120c.png URLScan capture report: https://urlscan.io/result/01a16c4f-07a8-717f-a00a-22bb14b4120c/ URLScan screenshot (2026-10-24T08:59:09Z): https://screenshots.phishdestroy.io/us/01a16d22-786f-7176-9506-37bab1702e3b.png URLScan capture report: https://urlscan.io/result/01a16d22-786f-7176-9506-37bab1702e3b/ VirusTotal report: https://www.virustotal.com/gui/domain/firehoussuber.delivery Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=firehoussuber.delivery Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-24 09:26:41 UTC ## Stored page captures - Primary capture: https://i.ibb.co/1YzH1HMB/e368d7f13b11.png Captured: 2026-10-24 08:57:04 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a16d1f-a86e-70d7-a548-4ef78a347b2b.png Captured: 2026-10-24 08:57:04 UTC Source report: https://urlscan.io/result/01a16d1f-a86e-70d7-a548-4ef78a347b2b/ - URLScan capture 2: https://urlscan.io/screenshots/01a16c4f-07a8-717f-a00a-22bb14b4120c.png Captured: 2026-10-24 08:53:50 UTC Source report: https://urlscan.io/result/01a16d1f-a86e-70d7-a548-4ef78a347b2b/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e11bf541-486b-4d80-b7bc-7c97a7847f22.png Captured: 2026-10-24 08:55:02 UTC Source report: https://radar.cloudflare.com/scan/e11bf541-486b-4d80-b7bc-7c97a7847f22 SHA-256: e474a175f992442a69e502e42d7748076f7b37bd4715cf7c03ed2b7ff55231c3 - URLQuery: https://screenshots.phishdestroy.io/uq/d4b28060-1050-4748-85e3-ab7137babe9c.png Source report: https://urlquery.net/report/d4b28060-1050-4748-85e3-ab7137babe9c SHA-256: 563c200bd58b0b9eaac3aa1ddde83df7872201f7b590df8c132211ddd27ea88b - URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a0a153-dd10-73e9-b217-c915bb62e12d.png Captured: 2026-09-14 19:10:37 UTC Source report: https://urlscan.io/result/01a0a153-dd10-73e9-b217-c915bb62e12d/ SHA-256: d144955f267e628798e0d91c183c3c70634db5fb0a55c37e18c2a30771925873 - URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a0a155-a1b7-7464-ad92-483f902c5502.png Captured: 2026-09-14 19:12:32 UTC Source report: https://urlscan.io/result/01a0a155-a1b7-7464-ad92-483f902c5502/ SHA-256: cf67ed32d5916b19cd28c2c8577ecb52db57e40ac8d13a27331192bd73ba2ef6 - URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12acc-1123-774d-848a-eb8d8dfcfbd4.png Captured: 2026-10-11 11:49:50 UTC Source report: https://urlscan.io/result/01a12acc-1123-774d-848a-eb8d8dfcfbd4/ SHA-256: 0efd9aff676ae31e2c1a8341f8328ba81ca2c2acea01adf75ce6d223bc77c882 - URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16c4f-07a8-717f-a00a-22bb14b4120c.png Captured: 2026-10-24 05:08:14 UTC Source report: https://urlscan.io/result/01a16c4f-07a8-717f-a00a-22bb14b4120c/ SHA-256: 0efd9aff676ae31e2c1a8341f8328ba81ca2c2acea01adf75ce6d223bc77c882 - URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16d22-786f-7176-9506-37bab1702e3b.png Captured: 2026-10-24 08:59:09 UTC Source report: https://urlscan.io/result/01a16d22-786f-7176-9506-37bab1702e3b/ SHA-256: 0efd9aff676ae31e2c1a8341f8328ba81ca2c2acea01adf75ce6d223bc77c882 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-24T09:26:04Z", "uuid": "01a16d1f-a86e-70d7-a548-4ef78a347b2b", "scanned_at": "2026-10-24T08:56:03Z", "final_url": "https://firehoussuber.delivery/v2/signin", "status": 200, "ip": "172.67.171.177", "domains": [ "czqk28jt.apicdn.sanity.io", "play.google.com", "cdn.cookielaw.org", "cdn.sanity.io", "api2.amplitude.com", "www.gstatic.com", "analytics.tiktok.com", "app.launchdarkly.com", "cdn0.forter.com", "events.launchdarkly.com", "app-cf.bc0a.com", "25891031ea204df287fabd2e398903a7-3e93093bbe14.cdn.forter.com", "api2.branch.io", "www.googletagmanager.com", "clientstream.launchdarkly.com", "ixfd2-api.bc0a.com", "pay.google.com", "connect.facebook.net", "region1.analytics.google.com", "use1-prod-fhs-gateway.rbictg.com", "maps.googleapis.com", "use.fontawesome.com", "sdk.iad-05.braze.com", "cdn6.forter.com", "cdn3.forter.com", "www.facebook.com", "mpc2-prod-29-is5qnl632q-uc.a.run.app", "www.google.de", "stats.g.doubleclick.net", "i.vimeocdn.com" ], "ips": [ "65.8.131.50", "18.64.211.113", "54.158.164.13", "44.221.203.91", "157.240.0.35", "34.143.79.2", "142.251.155.7", "35.155.61.91", "34.225.5.197", "142.251.110.94", "157.240.0.6", "23.207.210.133", "192.178.183.94", "142.251.127.156", "216.239.32.36" ], "asns": [ "16509", "14618", "32934", "396982", "15169", "20940", "54113", "13335", "6185" ], "countries": [ "US", "DE" ], "link_domains": [ "www.ezcater.com", "firehousesubsfoundation.org", "careers.firehoussuber.delivery", "www.franchising.firehoussuber.delivery", "www.firehousesubs.com", "www.franchising.firehousesubs.com", "apps.apple.com", "play.google.com", "news.firehousesubs.com", "careers.firehousesubs.com", "www.instagram.com", "www.facebook.com", "www.youtube.com", "twitter.com", "www.onetrust.com" ], "social": [ "https://www.instagram.com/firehousesubs", "https://www.facebook.com/firehousesubs", "https://www.youtube.com/channel/UCUN4J9T7bggwD2MJSj2uJmw", "https://twitter.com/FirehouseSubs" ], "doc_hash": "adbb57b8ebbdd74280f61d0cba6fe0de11934a66b2dd2a626566b72fc9654b03", "script_hashes": [ "5d297c586ca6761849231214edfc02c7a2a422e3e276c95d94806740c941ea21", "a790cc31d6ab27bde243c195ee9530f0d0767dd5d5de7074ea4d6386275a8c6c", "996fea80d65ef58fdef4eb963556db808a96d67302f4cfdd5fb5d3f9f686628e", "7d0ae0bf27e917c2337f1c51070c90074274e74fb96e8e45602df7f187e2520c", "d761387829020a70fc36b9fe086f1f3a7e6b79b919887b7e996cafa23eef037f", "1d0dcad480eda38b246121e96031e275ab05853fb0100703f2ffe433d17541c1" ], "globals": [ "BEJSSDKObserver", "jsElementReady", "BEJSSDK", "BEIXF", "__BUNDLE_START_TIME__", "__DEV__", "process", "__METRO_GLOBAL_PREFIX__", "__r", "__d", "__c", "__registerSegment", "$$require_external", "ErrorUtils", "__webpack_chunk_load__", "__webpack_require__", "REACT_NAVIGATION_DEVTOOLS", "expo", "__react_navigation__elements_contexts", "__loadBundleAsync", "__extends", "__assign", "__rest", "__decorate", "__param", "__esDecorate", "__runInitializers", "__propKey", "__setFunctionName", "__metadata", "__awaiter", "__generator", "__exportStar", "__createBinding", "__values", "__read", "__spread", "__spreadArrays", "__spreadArray", "__await" ], "cookies": [ "__cf_bm", "_ga", "_ga_MKSH9XMTWP", "NID", "_ttp", "_tt_enable_cookie", "ttcsid", "ttcsid_CR1PN6BC77U8E82MVRIG", "_fbp", "forterToken", "_dd_s" ], "storage_keys": [ "__storejs__test__", "ab.test", "ab.storage.events.bbca207a-191b-493f-8cad-7a6a4d563b3d", "ab.storage.sessionId.bbca207a-191b-493f-8cad-7a6a4d563b3d", "ab.storage.messagingSessionStart.bbca207a-191b-493f-8cad-7a6a4d563b3d", "ab.storage.deviceId.bbca207a-191b-493f-8cad-7a6a4d563b3d", "ab.storage.lastSdkReq.bbca207a-191b-493f-8cad-7a6a4d563b3d", "ab.storage.lastReqToEndpoint.bbca207a-191b-493f-8cad-7a6a4d563b3d", "RBI::LAUNCH_DARKLY_USER_ATTRIBUTES", "ab.storage.attributes.bbca207a-191b-493f-8cad-7a6a4d563b3d", "AMP_TEST", "RBI::ORDER", "RBI::APPLIED_LOYALTY_OFFERS", "RBI::APPLIED_LOYALTY_REWARDS", "RBI::OFFERS_REDEEMED_NO_AUTH" ], "tls": { "san": [ "*.firehoussuber.delivery", "firehoussuber.delivery" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "firehoussuber.delivery", "protocol": "QUIC", "valid_to": "2026-12-13T17:40:28Z", "valid_from": "2026-09-14T17:40:29Z" }, "domain_age_days": 39, "apex_age_days": 39, "tls_age_days": 39, "tls_valid_days": 89, "requests": 140, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 80, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html", "referrer-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-24T08:55:40Z", "uuid": "e11bf541-486b-4d80-b7bc-7c97a7847f22", "scanned_at": "2026-10-24T08:55:02Z", "final_url": "https://firehoussuber.delivery/", "status": 200, "history": [ { "url": "https://firehoussuber.delivery/", "status": 200 } ], "dom_hash": "3d1088dc8a672e00d742556e9e028c0a5b6aafb090978409c5395398af21d49d", "doc_hash": "d53de2f9e308da490c4fb966e7c9b5997d736cc3870c18e27cc164e4d765638b", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "firehoussuber.delivery", "type": "A", "value": "172.67.171.177" }, { "name": "firehoussuber.delivery", "type": "A", "value": "104.21.47.172" }, { "name": "firehoussuber.delivery", "type": "AAAA", "value": "2606:4700:3037::ac43:abb1" }, { "name": "firehoussuber.delivery", "type": "AAAA", "value": "2606:4700:3031::6815:2fac" } ], "dnssec_valid": false, "ip": "172.67.171.177", "whois": { "registrar": "Dynadot Inc", "created": "2026-09-14T14:18:06Z", "updated": "2026-09-19T14:18:59Z", "expires": "2027-09-14T14:18:06Z", "nameservers": [ "jobs.ns.cloudflare.com", "vivienne.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-24T09:25:17Z", "analysis_at": "2026-10-24T09:17:29Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "first_seen": "2026-09-14T19:01:46Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "jobs.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "jobs.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::6815:2fac" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::ac43:abb1" }, { "ttl": 300, "type": "A", "value": "172.67.171.177" }, { "ttl": 21600, "type": "NS", "value": "vivienne.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.47.172" } ], "dns_at": "2026-10-24T09:22:49Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.firehoussuber.delivery", "firehoussuber.delivery" ], "issuer": "Let's Encrypt / YE2", "serial": "55f3f9a2eb4a4ea32b3100d5d6675731b1e", "sha256": "aee912533f8489f0814705167816cd1d8624d427c296c0a44e19a7d6fee2d05e", "subject": "firehoussuber.delivery", "valid_to": "2026-12-13T17:40:28Z", "valid_from": "2026-09-14T17:40:29Z" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-09-14T14:18:06Z", "last changed": "2026-09-14T18:30:31Z", "registration": "2026-09-14T14:18:06Z", "registrar expiration": "2027-09-14T14:18:06Z", "last update of RDAP database": "2026-10-23T11:13:53Z" }, "registrar": "DYNADOT LLC", "registrar_iana_id": "472" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-24T08:56:01Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "firehoussuber.delivery" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-24T08:55:37Z", "first": "2026-09-14T21:18:23Z", "changes": 2, "days_archived": 3, "scans_per_day": 0.05, "avg_page_bytes": 3894 }, "sitemap": { "present": true, "url_count": 1322 }, "social_tags": { "title": "Firehouse Subs", "themeColor": "#ffffff" }, "trackers": { "requests": 25, "trackers": [ { "name": "Google", "company": "Google", "country": "US", "category": "Advertising", "requests": 3 }, { "name": "fontawesome.com", "company": "fontawesome.com", "category": "Hosting", "requests": 2 }, { "name": "Google Play Services", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 6 }, { "name": "Braze", "company": "Braze", "country": "US", "category": "Site Analytics", "requests": 2 }, { "name": "Apple Pay", "company": "Apple", "country": "US", "category": "Utilities", "requests": 1 }, { "name": "Launch Darkly", "company": "LaunchDarkly", "country": "US", "category": "Utilities", "requests": 3 } ] }, "mixed_content": { "no_sri": [ "https://cdn.bc0a.com/autopilot/f00000000030803/autopilot_sdk.js", "https://pay.google.com/gp/p/js/pay.js", "https://applepay.cdn-apple.com/jsapi/v1/apple-pay-sdk.js" ], "third_party_scripts": 3 }, "status": { "up": true, "code": 200, "timings": { "dns": 318, "tls": 45, "wait": 435, "connect": 41, "download": 0 }, "response_ms": 839 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 9396, "co2_grams": 0.0003, "cleaner_than": 73 }, "dns_server": { "ns": [ { "ip": "108.162.193.183", "host": "jobs.ns.cloudflare.com" }, { "ip": "172.64.34.50", "host": "vivienne.ns.cloudflare.com" } ], "zone": "firehoussuber.delivery" }, "cookies": { "cookies": [ { "name": "NID", "secure": true, "http_only": true, "same_site": "None" } ] }, "location": { "ip": "2606:4700:3031::6815:2fac", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "firehoussuber.delivery" }, "dns": { "A": [ "172.67.171.177", "104.21.47.172" ], "NS": [ "jobs.ns.cloudflare.com", "vivienne.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"jobs.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415124374, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3031::6815:2fac", "2606:4700:3037::ac43:abb1" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "same-origin", "xXSSProtection": "1; mode=block", "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3031::6815:2fac", "family": 6 }, "redirects": { "chain": [ "https://firehoussuber.delivery" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html", "referrer-policy": "same-origin" } } } } ```