# PhishDestroy domain threat record: gabihazut.co.il Content language: English Canonical HTML report: https://phishdestroy.io/domain/gabihazut.co.il/ Machine-readable companion: https://phishdestroy.io/domain/gabihazut.co.il/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-05 19:14:52 UTC - Last availability or vendor check: 2026-10-22 10:28:30 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 14/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 34.142.38.194 - Registrar in stored WHOIS data: Gorni Interactive Ltd - Registrar country in stored WHOIS data: Unknown - Last stored HTTP status: 200 ## Evidence links - URLScan report: https://urlscan.io/result/01a072fd-7d80-7797-9594-e70f62966823/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/gabihazut.co.il - Certificate Transparency search: https://crt.sh/?q=%25.gabihazut.co.il - Web Archive lookup: https://web.archive.org/web/*/https://gabihazut.co.il/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview gabihazut.co.il poses as the lessons website of Dr. Gabriel Hazut. Its Hebrew title, "ד"ר חזות גבריאל – אתר השיעורים של ד"ר גבריאל חזות", translates to "Dr. Hazut Gabriel – the lessons site of Dr. Gabriel Hazut." We class it as an impersonation phishing page aimed at people who attend or follow his classes. PhishDestroy first detected it on 2026-09-05, and the site was still up with live content on 2026-10-19. How the scam works A familiar teacher's name lowers a visitor's guard. Students who arrive looking for class recordings, schedules or registration are more likely to log in, sign up or pay without checking who runs the page. Whatever they type, including names, phone numbers, email addresses, passwords and card or donation details, can end up with the operators. Captured passwords are commonly replayed against email, banking and social accounts where the victim used the same login. Evidence When VirusTotal scanned the domain on 2026-09-18, 14 of its 89 engines marked it as malicious. ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, ESET, Forcepoint ThreatSeeker, Fortinet and G-Data are among the vendors that flagged it, a broad spread of independent verdicts for a small Hebrew-language site. Researchers have referenced it in 31 AlienVault OTX threat pulses. PhishDestroy is so far the only blocklist we track that carries it, so many browsers and mail filters may still let visitors reach the page. Infrastructure The .co.il name was registered through Gorni Interactive Ltd. The site is served from Google LLC cloud servers in the United Kingdom at 34.142.38.194, far from the Israeli audience it targets. A Let's Encrypt certificate from the YE2 issuer gives it a browser padlock. That padlock confirms only that the connection is encrypted and says nothing about who operates the site. What to do Anyone who typed a password on gabihazut.co.il should change it right away, along with every other account sharing that password, and enable two-factor authentication. If you paid or entered card details, call your bank to dispute the charge and have the card reissued. Be wary of calls, texts or emails that mention your registration or ask for more information. To reach Dr. Hazut's real lessons, rely on contact details you already trust. Security teams should block the domain and its IP at DNS, proxy and mail gateways and report it to the .co.il registry and Google Cloud. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a072fd-7d80-7797-9594-e70f62966823/ VirusTotal report: https://www.virustotal.com/gui/domain/gabihazut.co.il Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gabihazut.co.il Archived copy: https://web.archive.org/web/20260922091346/https://gabihazut.co.il/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:49:17 UTC ## Stored page captures - Primary capture: https://i.ibb.co/xKdFgSsv/b6d99bfd6597.png Captured: 2026-09-05 19:14:52 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a072fd-7d80-7797-9594-e70f62966823.png Captured: 2026-09-05 19:14:52 UTC Source report: https://urlscan.io/result/01a072fd-7d80-7797-9594-e70f62966823/ - URLQuery: https://screenshots.phishdestroy.io/uq/f5c8d41a-889e-4239-b482-4e179e71a7fd.png Captured: 2026-09-05 19:29:57 UTC Source report: https://urlquery.net/report/f5c8d41a-889e-4239-b482-4e179e71a7fd SHA-256: 41f19713c6e0b8831d63d6b5b25fb0ce08633f426122412ec7173fdd26198ce7 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/109f2396-ea64-46cd-99cb-6472c48b9395.png Captured: 2026-09-05 19:56:39 UTC Source report: https://radar.cloudflare.com/scan/109f2396-ea64-46cd-99cb-6472c48b9395 SHA-256: af4f5a74b9ba8e07c7324577543e59fcd8a162d5f16b516563344410992034b5 - URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a072f2-dab3-754c-a480-9a99d7e0d55d.png Captured: 2026-09-05 19:02:00 UTC Source report: https://urlscan.io/result/01a072f2-dab3-754c-a480-9a99d7e0d55d/ SHA-256: 281a5761c499d13ce649ebaaa9241103c992ad647bcd2520cb89e59c29ad8ac1 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:48:54Z", "uuid": "01a072fd-7d80-7797-9594-e70f62966823", "scanned_at": "2026-09-05T19:13:37Z", "final_url": "https://gabihazut.co.il/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://gabihazut.co.il/", "from": "http://gabihazut.co.il/", "status": 307 } ], "ip": "34.142.38.194", "ptr": "194.38.142.34.bc.googleusercontent.com", "domains": [ "i1.ytimg.com", "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "64.233.180.139", "173.194.205.94", "142.251.167.95", "34.142.38.194" ], "asns": [ "15169", "396982" ], "countries": [ "US", "GB" ], "link_domains": [ "he.wikipedia.org", "www.youtube.com", "youtu.be", "generatepress.com" ], "social": [ "https://www.youtube.com/watch" ], "doc_hash": "d26e26cd12e073e6f08ae3f1f53ed71a80e0a3f190879431ff544a959ae4d360", "script_hashes": [ "f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a" ], "globals": [ "two_worker_data_critical_data", "two_worker_data_font", "two_worker_data_excluded_js", "two_worker_data_js", "two_worker_data_css", "logLoaded", "applyElementorControllers", "applyViewCss", "two_scripts_load", "two_load_delayed_javascript", "two_loading_events", "two_delayed_loading_attribute", "two_delayed_js_load_libs_first", "two_delayed_loading_events", "two_event_listeners", "LazyLoad", "two_lazyLoadInstance", "two_script_list", "two_excluded_js_list", "excluded_count", "two_css_list", "two_fonts_list", "two_critical_data", "wcode", "two_worker", "two_worker_data", "UpdateQueryString", "two_connect_failed_style", "two_connect_style", "two_connect_script", "two_load_delayed_js", "two_connect_font", "two_styles_loaded", "two_worker_styles_list", "two_worker_styles_count", "two_page_loaded", "onStylesLoadEvent", "two_font_actions", "connect_stile_timeout" ], "tls": { "san": [ "gabihazut.co.il", "www.gabihazut.co.il" ], "cipher": "AES_256_GCM", "issuer": "YE2", "subject": "gabihazut.co.il", "protocol": "TLS 1.3", "valid_to": "2026-11-04T00:42:20Z", "valid_from": "2026-08-06T00:42:21Z" }, "domain_age_days": 3257, "apex_age_days": 3257, "tls_age_days": 30, "tls_valid_days": 89, "requests": 48, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -92, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html; charset=UTF-8", "strict-transport-security": "max-age=31536000; includeSubdomains; preload", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T03:59:41Z", "uuid": "109f2396-ea64-46cd-99cb-6472c48b9395", "scanned_at": "2026-09-05T19:56:39Z", "final_url": "https://gabihazut.co.il/", "status": 200, "history": [ { "url": "https://gabihazut.co.il/", "status": 200 } ], "dom_hash": "9d9bdb21325cc2b912473b31b61250290aa39e2130ff6bdbf4a038508f32a6d5", "doc_hash": "bbbc8c92986dca454e911bb1e28d7817be3d4f8bead89879057bdf15b2355492", "domain_risks": [ "Religion & Spirituality", "Religion" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "gabihazut.co.il", "type": "A", "value": "34.142.38.194" } ], "dnssec_valid": false, "ip": "34.142.38.194", "whois": { "registrar": "Gorni Interactive Ltd", "nameservers": [ "bob.ns.cloudflare.com", "cloe.ns.cloudflare.com" ] } } } ```