ChainPatrol
Web-Check 
SOCRadar 
LeakIX 
MALICIOUS — CRITICAL
gassafor[.]com
3 of 91 security engines flagged the domain; the latest stored check returned HTTP 302.
76/100 evidence score · Critical
- VirusTotal
- 3/91
- Blocklists
- No stored match
- Availability
- Last known active · HTTP 302
No capture stored
Do not enter credentials, seed phrases, payment details, or personal information on this domain.
Jump to section
Evidence Digest
gassafor.com is classified critical with an evidence score of 76/100. 3 of 91 security engines flagged the domain. Registered 11 May 2026 via Soluciones Corporativas IP, SL, hosted on 193.70.22.241 (OVH SAS, ES). The latest stored check on 9 Aug 2026 returned HTTP 302.
Stored generated summary (templated)grok · Jul 12, 2026
Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.
Analysis indicates that gassafor.com was registered on May 11 2026 through Soluciones Corporativas IP SL and currently resolves to IP address 193.70.22.241 located in ES. The domain uses nameservers ns1.deprueba.es and ns2.deprueba.es along with an SSL certificate issued by Let's Encrypt R13. HTTP responses return status code 302 indicating an immediate redirect. The observed page title Inicio - Disgas matches the branding of a known energy services provider and supports the classification of generic phishing activity.
Multiple detection sources have recorded the domain. It appears on one security blocklist, receives a Gridinsoft trust score of 35 out of 100, and is referenced in a single AlienVault OTX threat intelligence pulse. VirusTotal reports that one of 95 vendors flags the domain. The domain remains listed as active with high risk level and continues to be blocked by PhishDestroy at the time of this report.
Infrastructure details show the domain is hosted on OVH Hispano resources while the 302 redirect behavior prevents direct inspection of final landing content. Registration age of approximately two months is consistent with patterns observed in other short-lived phishing operations. No additional ASN or brand kit indicators are present in the available data.
Defenders should block the IP 193.70.22.241 and the domain gassafor.com at network and endpoint layers. Organizations protecting Disgas users are advised to add the domain to internal blocklists and monitor for similar redirects using the same nameserver pair. Continued observation of the single blocklist appearance and OTX pulse is recommended to track any infrastructure reuse.
VirusTotal
3 det.
OTX references
Gridinsoft
35/100
TLS Certificate
Expired or unverified -29d
Age
3 mo
Observed status
Last known active 302
DestroyList
Listed
Data coverage13 recorded checks
VirusTotal
3 / 91
URLQuery
not checked
PhishStats
not checked
OTX
1 community reference
CF Radar
no data
URLScan capture
not submitted
URLScan verdict
verdict unavailable
DNS blocks
not checked
TLS
Expired or unverified
WHOIS
3 mo old
Screenshot
not captured
Redirect chain
not probed
Gridinsoft
35/100
Security Signals
Gridinsoft Analysis
35 / 100
Threat Response Pipeline
Discovery
Checks
Reports
Availability
6/8
Public Blocklist Status
Domain Intelligence
Domain
Server / ASN
Apache · AS16276 OVH SAS
IP Reputation
abuse score 0/100 4 reports checked Jul 13, 2026
Registrar
Soluciones
IP Address
193.70.22.241
RegistrationCreated May 11, 2026 (90d)
HTTP Status302 Found (Temporary)
Technical detailsDNS, SSL SANs, timestamps
First DetectedJun 15, 2026
Nameserversns2.deprueba.es
TLS Fingerprint
TLS Observationvalid from Apr 12, 2026scanned May 16, 2026
ICANN OVERSIGHT
Accreditation and RAA context
Accreditation and RAA context
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Accreditation is a contract, not a safety seal.
Verify ICANN fees
Read RAA §3.18
PHISHDESTROY INVESTIGATIONICANN funding, contracts, and DNS abuse oversight
Report This Domain
Submit evidence & help protect others
VirusTotal Analysis
3 / 91 security vendors flagged this domain
View on VT
Last analyzed First positive detection Previous stored snapshot: 0 detections
CRDF
Gridinsoft
SOCRadar
Evidence & External ReportsIndependent lookups and source reports
Security Analysis
OSINT & Intelligence
DNS & Network
SEO & Domain
Victim safety and official reportingImmediate actions and verified reporting channels
If credentials were compromised, report immediately. Do not engage with recovery scammers.
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Action Fraud
Report fraud and cybercrime in England, Wales and Northern Ireland
Contact centre0300 123 2040
PhishDestroy listing review Not a law-enforcement report
Domain Appeal
Request a review if you own this domain and believe the listing is incorrect
Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
97-country directory
Template-based draft • optional AI wording assistance requires separate consent
Review and submit it yourself
Related Infrastructure & ReportsStored relationships and adjacent records
Same registrar: Soluciones 2
fcb.ad Recent threat reports 6
Recently added threat reports.
lizsbs.shop