# PhishDestroy domain threat record: free-5668904.webadorsite.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/free-5668904.webadorsite.com/
Machine-readable companion: https://phishdestroy.io/domain/free-5668904.webadorsite.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-23 12:39:41 UTC
- Stored record updated: 2026-10-23 18:21:27 UTC
- VirusTotal detections in the stored snapshot: 5/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: OpenPhish
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 34.90.225.198
- Registrar in stored WHOIS data: Hosting Concepts B.V. d/b/a Registrar.eu
- Last stored HTTP status: 200
- Registration date (registry RDAP, webadorsite.com): 2019-11-21 11:21:06 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16782-571c-72db-87c4-25f268f33fbc/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/free-5668904.webadorsite.com
- Certificate Transparency search: https://crt.sh/?q=%25.free-5668904.webadorsite.com
- Web Archive lookup: https://web.archive.org/web/*/https://free-5668904.webadorsite.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI classified free-5668904.webadorsite.com as malicious because it pretends to be “Ricardo Support” and displays a phone number for technical assistance, a pattern commonly used in tech‑support scams. The domain was first observed by PhishDestroy on 2026-10-23 and a page fetch on that date returned HTTP 200.

How the scam works
In a tech‑support scam, attackers mimic a legitimate brand’s support channel, contact victims by phone, claim the victim’s device or account is compromised, and then persuade the victim to grant remote access, install software, or pay for bogus repairs. The goal is to obtain credentials, payment, or install malware without the victim’s informed consent.

Evidence
VirusTotal scanned the domain on 2026-10-22 and reported five malicious detections out of 92 engines, with AlphaMountain.ai, Fortinet, G-Data, Sophos and Webroot labeling it as phishing; the same scan also tagged the domain as a DGA. Google Safe Browsing checked on 2026-10-23 and returned no flag. urlscan.io captured the page on 2026-10-23; its machine‑learning engine gave a malicious score of 90 and applied phishing‑related tags, while the overall verdict was non‑malicious. PhishDestroy’s internal blocklist marks the domain as malicious, external blocklists reported zero hits, and OTX showed zero pulses as of 2026-10-23.

Infrastructure
The recorded IP was 34.90.225.198, belonging to Google LLC, and the recorded country was NL. The site used a CNAME to editor.jouwweb.nl as observed in DNS records. A Let’s Encrypt certificate covering *.webadorsite.com was recorded, valid from 2026-09-23 to 2026-12-22. At the time of observation the domain age was 162 days.

What to do
Visitors should avoid calling the displayed support number and should not provide any credentials or remote‑access permissions. If any personal data was entered, change the affected passwords and monitor accounts for suspicious activity. Defenders should block the exact domain, log any connections to it, and treat traffic from this address as potentially malicious.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16782-571c-72db-87c4-25f268f33fbc/
Cloudflare Radar report: https://radar.cloudflare.com/scan/c3c91886-a14b-497f-802d-cbc8d741453b
Stored capture screenshot: https://urlscan.io/screenshots/01a16782-571c-72db-87c4-25f268f33fbc.png
Cloudflare Radar screenshot (2026-10-23T12:41:50Z): https://screenshots.phishdestroy.io/cf/c3c91886-a14b-497f-802d-cbc8d741453b.png
URLScan screenshot (2026-10-16T20:18:42Z): https://screenshots.phishdestroy.io/us/01a1465d-ccbc-7458-93b4-79e62359e630.png
URLScan capture report: https://urlscan.io/result/01a1465d-ccbc-7458-93b4-79e62359e630/
VirusTotal report: https://www.virustotal.com/gui/domain/free-5668904.webadorsite.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=free-5668904.webadorsite.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 13:44:23 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a16782-571c-72db-87c4-25f268f33fbc.png
  Captured: 2026-10-23 12:39:41 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a16782-571c-72db-87c4-25f268f33fbc.png
  Source report: https://urlscan.io/result/01a16782-571c-72db-87c4-25f268f33fbc/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c3c91886-a14b-497f-802d-cbc8d741453b.png
  Captured: 2026-10-23 12:41:50 UTC
  Source report: https://radar.cloudflare.com/scan/c3c91886-a14b-497f-802d-cbc8d741453b
  SHA-256: b76864779e66973b24a06dcbb42650d1de92cb57be2921a094a0c3873faba362
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1465d-ccbc-7458-93b4-79e62359e630.png
  Captured: 2026-10-16 20:18:42 UTC
  Source report: https://urlscan.io/result/01a1465d-ccbc-7458-93b4-79e62359e630/
  SHA-256: cc1e8a58f0379d86a816aba404b4a87d12c9737e4a8bc0adf9e147884ac8056a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T12:42:47Z",
        "uuid": "01a16782-571c-72db-87c4-25f268f33fbc",
        "scanned_at": "2026-10-23T06:46:05Z",
        "final_url": "https://free-5668904.webadorsite.com/ricardo-support",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://free-5668904.webadorsite.com/ricardo-support",
                "from": "https://free-5668904.webadorsite.com/ricardo-support/",
                "status": 301
            }
        ],
        "ip": "34.90.225.198",
        "ptr": "198.225.90.34.bc.googleusercontent.com",
        "domains": [
            "assets.jwwb.nl",
            "gfonts.jwwb.nl",
            "primary.jwwb.nl",
            "plausible.io"
        ],
        "ips": [
            "151.101.1.55",
            "151.101.193.55",
            "151.101.65.91",
            "138.199.40.58",
            "34.90.225.198"
        ],
        "asns": [
            "54113",
            "60068",
            "396982"
        ],
        "countries": [
            "US",
            "NL"
        ],
        "link_domains": [
            "www.webador.com"
        ],
        "doc_hash": "62b8bb299c01d276c966e6596343e92c75e18986c1ca579fa8bdd80daf220a2d",
        "globals": [
            "JOUWWEB",
            "plausible",
            "webpackChunkjouwweb",
            "clearImmediate",
            "setImmediate",
            "$",
            "jQuery"
        ],
        "cookies": [
            "JwStickySession"
        ],
        "tls": {
            "san": [
                "*.webadorsite.com",
                "webadorsite.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "*.webadorsite.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-22T23:05:05Z",
            "valid_from": "2026-09-23T23:05:06Z"
        },
        "domain_age_days": 162,
        "apex_age_days": 162,
        "tls_age_days": 29,
        "tls_valid_days": 89,
        "requests": 18,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 90,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=UTF-8",
            "content-security-policy": "frame-ancestors 'self'",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T12:42:49Z",
        "uuid": "c3c91886-a14b-497f-802d-cbc8d741453b",
        "scanned_at": "2026-10-23T12:41:50Z",
        "final_url": "https://free-5668904.webadorsite.com/",
        "status": 200,
        "history": [
            {
                "url": "https://free-5668904.webadorsite.com/",
                "status": 200
            }
        ],
        "dom_hash": "48f9a6455f0c7ef665d027579ea7aefc2ec2b9ca31fac599e21f8191f41baa45",
        "doc_hash": "6c3645bfc7df2cbcf079309b89940b674d836df14c22dd8cb12794d552b50fdd",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "free-5668904.webadorsite.com",
                "type": "CNAME",
                "value": "editor.jouwweb.nl"
            },
            {
                "name": "free-5668904.webadorsite.com",
                "type": "CNAME",
                "value": "editor.jouwweb.nl"
            }
        ],
        "dnssec_valid": false,
        "ip": "34.90.225.198",
        "whois": {
            "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
            "created": "2019-11-21T11:21:06Z",
            "updated": "2025-12-08T18:51:28Z",
            "expires": "2026-11-21T11:21:06Z",
            "nameservers": [
                "ns-cloud-e1.googledomains.com",
                "ns-cloud-e2.googledomains.com",
                "ns-cloud-e3.googledomains.com",
                "ns-cloud-e4.googledomains.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T13:43:47Z",
        "analysis_at": "2026-10-22T14:17:37Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 5,
            "suspicious": 0,
            "undetected": 34
        },
        "detections": {
            "G-Data": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "created": "2019-11-21T00:00:00Z",
        "updated": "2025-12-08T00:00:00Z",
        "first_seen": "2026-05-13T10:48:49Z",
        "dns": [
            {
                "ttl": 10390,
                "type": "A",
                "value": "34.90.225.198"
            },
            {
                "ttl": 10800,
                "type": "CNAME",
                "value": "editor.jouwweb.nl"
            }
        ],
        "dns_at": "2026-10-22T14:23:02Z",
        "jarm": "29d3fd00029d29d00042d43d0000000464fb8c6842ac133bede81390a48134",
        "cert": {
            "san": [
                "*.webadorsite.com",
                "webadorsite.com"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "65d156b8c8d8b57bf38dc1735f120580409",
            "sha256": "b57fa96865b3e7d69e3fe106e9fce1c04d84e3d51fcf92999178bd76c6efa5af",
            "subject": "*.webadorsite.com",
            "valid_to": "2026-12-22T23:05:05Z",
            "valid_from": "2026-09-23T23:05:06Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T12:43:02Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "free-5668904.webadorsite.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-23T12:39:55Z",
            "first": "2026-10-23T12:39:55Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 9336
        },
        "robots_txt": {
            "present": true,
            "sitemaps": [
                "https://free-5668904.webadorsite.com/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 2
        },
        "security_txt": {
            "present": true,
            "found_in": "/.well-known/security.txt"
        },
        "social_tags": {
            "ogUrl": "https://free-5668904.webadorsite.com/",
            "title": "Ricardo Support",
            "robots": "noindex,nofollow",
            "ogImage": "https://assets.jwwb.nl/assets/templates/boats-banner/explorer/images/slideshow.jpg",
            "ogTitle": "Ricardo Support",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://free-5668904.webadorsite.com/"
        },
        "trackers": {
            "requests": 20,
            "trackers": [
                {
                    "name": "Plausible Analytics",
                    "company": "Plausible Insights",
                    "country": "EE",
                    "category": "Utilities",
                    "requests": 2
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://plausible.io/js/script.manual.js",
                "https://assets.jwwb.nl/assets/website-rendering-i18n/en-GB.js",
                "https://assets.jwwb.nl/assets/website-rendering/runtime.a2455a67aab510c8778e.js",
                "https://assets.jwwb.nl/assets/website-rendering/964.a958855da07340f5fab3.js",
                "https://assets.jwwb.nl/assets/website-rendering/main.50c8690854393a64f59c.js"
            ],
            "third_party_scripts": 5
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 6,
                "tls": 22,
                "wait": 123,
                "connect": 14,
                "download": 1
            },
            "response_ms": 166
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 33028,
            "co2_grams": 0.0012,
            "cleaner_than": 46
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "216.239.38.110",
                    "host": "ns-cloud-e4.googledomains.com"
                },
                {
                    "ip": "216.239.34.110",
                    "host": "ns-cloud-e2.googledomains.com"
                },
                {
                    "ip": "216.239.36.110",
                    "host": "ns-cloud-e3.googledomains.com"
                },
                {
                    "ip": "216.239.32.110",
                    "host": "ns-cloud-e1.googledomains.com"
                }
            ],
            "zone": "webadorsite.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "JwStickySession",
                    "secure": true,
                    "http_only": true
                }
            ]
        },
        "location": {
            "ip": "34.90.225.198",
            "asn": "396982",
            "org": "Google LLC",
            "city": "Groningen",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "*.webadorsite.com"
        },
        "dns": {
            "A": [
                "34.90.225.198"
            ],
            "CNAME": [
                "editor.jouwweb.nl"
            ]
        },
        "dnssec": {
            "ds": true,
            "rrsig": false,
            "dnskey": true
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "frame-ancestors 'self'",
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "34.90.225.198",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://free-5668904.webadorsite.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "JouwWeb",
                "Nginx",
                "Plausible",
                "core-js",
                "Webpack",
                "Open Graph",
                "Module Federation"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.webador.com/",
                "https://www.webador.com/"
            ],
            "external_count": 2,
            "internal_count": 3
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html; charset=UTF-8",
                "content-security-policy": "frame-ancestors 'self'",
                "x-content-type-options": "nosniff"
            }
        }
    }
}
```