# PhishDestroy domain threat record: giyilmiscorap.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/giyilmiscorap.com/
Machine-readable companion: https://phishdestroy.io/domain/giyilmiscorap.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-28 00:45:17 UTC
- Stored record updated: 2026-10-28 01:02:41 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 162.4.84.255
- Registrar in stored WHOIS data: Realtime Register B.V.
- Registration date in stored WHOIS data: 2025-10-21 13:48:34 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019f5d06-ec7d-7518-ab08-4adab6f252ea/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/giyilmiscorap.com
- Certificate Transparency search: https://crt.sh/?q=%25.giyilmiscorap.com
- Web Archive lookup: https://web.archive.org/web/*/https://giyilmiscorap.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed giyilmiscorap.com as a suspicious domain. The recorded page title was “Redirecting…”. The domain was first seen by PhishDestroy on 2026-10-28, when a fetch returned HTTP 200.

How the scam works
The available detections label the site as phishing, which generally means it could be used to trick users into entering credentials or personal data. No specific malicious payload or credential‑stealing form was observed on the captured page.

Evidence
VirusTotal reported 12 malicious and 3 suspicious detections out of 92 engines on 2026-10-28, with vendors such as BitDefender, G-Data and Sophos flagging it as phishing. Google Safe Browsing checked the domain on 2026-10-28 and did not flag it. Cloudflare Radar scanned the domain on 2026-10-28 and returned a malicious verdict in the malware category. URLScan captured a screenshot on 2026-07-13 and gave a clean verdict. OTX listed two pulses mentioning the domain as of 2026-10-28. PhishDestroy’s internal blocklist marked the domain as blocked, while external blocklists showed zero hits on the same date.

Infrastructure
The domain was registered with Realtime Register B.V. on 2025-10-21 and was set to expire on 2027-10-21. The recorded IP address was 162.4.84.255, associated with ParkLogic Pty Ltd in Australia; the DNS records observed at the time included an A record, an MX record pointing to mx156.hostedmxserver.com, NS records ns1.parklogic.com and ns2.parklogic.com, a CAA record for Let’s Encrypt, and an SPF TXT record of “v=spf1 -all”. The TLS certificate captured in the scan was a Let’s Encrypt certificate issued on 2026-10-21 and valid until 2027-01-19.

What to do
Visitors should avoid entering any credentials or personal information on the site; if they have already done so, they should change the associated passwords. Defenders can add the domain name to blocklists and monitor logs for connections to giyilmiscorap.com. Continue to watch for updates from security feeds, as the evidence reflects the state of the domain as of the last checks.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019f5d06-ec7d-7518-ab08-4adab6f252ea/
Cloudflare Radar report: https://radar.cloudflare.com/scan/377a3123-e92d-43a3-99b5-9ef90aeda173
Stored capture screenshot: https://urlscan.io/screenshots/019f5d06-ec7d-7518-ab08-4adab6f252ea.png
Cloudflare Radar screenshot (2026-10-28T00:47:18Z): https://screenshots.phishdestroy.io/cf/377a3123-e92d-43a3-99b5-9ef90aeda173.png
URLScan screenshot (2026-06-18T20:15:17Z): https://screenshots.phishdestroy.io/us/019edc5f-8ef4-70d9-8cd7-e0cf52197829.png
URLScan capture report: https://urlscan.io/result/019edc5f-8ef4-70d9-8cd7-e0cf52197829/
URLScan screenshot (2026-06-19T10:00:38Z): https://screenshots.phishdestroy.io/us/019edf53-36cd-730f-ac11-c4889844fa94.png
URLScan capture report: https://urlscan.io/result/019edf53-36cd-730f-ac11-c4889844fa94/
URLScan screenshot (2026-07-07T06:18:35Z): https://screenshots.phishdestroy.io/us/019f3b3a-627d-76cc-9d6a-1037d46ffdb5.png
URLScan capture report: https://urlscan.io/result/019f3b3a-627d-76cc-9d6a-1037d46ffdb5/
URLScan screenshot (2026-10-28T00:45:56Z): https://screenshots.phishdestroy.io/us/01a17ff8-5ad9-767c-93c0-207c1b960e7e.png
URLScan capture report: https://urlscan.io/result/01a17ff8-5ad9-767c-93c0-207c1b960e7e/
URLScan screenshot (2026-10-28T00:49:04Z): https://screenshots.phishdestroy.io/us/01a17ffb-4fe2-73cc-83d5-b754f9ee8c6f.png
URLScan capture report: https://urlscan.io/result/01a17ffb-4fe2-73cc-83d5-b754f9ee8c6f/
VirusTotal report: https://www.virustotal.com/gui/domain/giyilmiscorap.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=giyilmiscorap.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 00:51:51 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019f5d06-ec7d-7518-ab08-4adab6f252ea.png
  Captured: 2026-10-28 00:45:17 UTC
- URLScan · 2026-06-18: https://screenshots.phishdestroy.io/us/019edc5f-8ef4-70d9-8cd7-e0cf52197829.png
  Captured: 2026-06-18 20:15:17 UTC
  Source report: https://urlscan.io/result/019edc5f-8ef4-70d9-8cd7-e0cf52197829/
  SHA-256: 4a4697f6bf8e04eb88f48727552946ca2b9bcdefa0f2c9f52a4823fcfc85fe32
- URLScan · 2026-06-19: https://screenshots.phishdestroy.io/us/019edf53-36cd-730f-ac11-c4889844fa94.png
  Captured: 2026-06-19 10:00:38 UTC
  Source report: https://urlscan.io/result/019edf53-36cd-730f-ac11-c4889844fa94/
  SHA-256: 4a4697f6bf8e04eb88f48727552946ca2b9bcdefa0f2c9f52a4823fcfc85fe32
- URLScan · 2026-07-07: https://screenshots.phishdestroy.io/us/019f3b3a-627d-76cc-9d6a-1037d46ffdb5.png
  Captured: 2026-07-07 06:18:35 UTC
  Source report: https://urlscan.io/result/019f3b3a-627d-76cc-9d6a-1037d46ffdb5/
  SHA-256: 8186a41496a5104dbc2a06a28c95ca1ca351d2f475ef04612624bd7f3d886bcc
- URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a17ff8-5ad9-767c-93c0-207c1b960e7e.png
  Captured: 2026-10-28 00:45:56 UTC
  Source report: https://urlscan.io/result/01a17ff8-5ad9-767c-93c0-207c1b960e7e/
  SHA-256: 5aa4bed52bbaab9644a84963dc270e01df4d94ce3efb4f6910779b16cc435e4a
- URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a17ffb-4fe2-73cc-83d5-b754f9ee8c6f.png
  Captured: 2026-10-28 00:49:04 UTC
  Source report: https://urlscan.io/result/01a17ffb-4fe2-73cc-83d5-b754f9ee8c6f/
  SHA-256: f5bb9c90cd1a0226fc16161d03f1c51396d575ccb6e9124304f8ed20374a2075
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/377a3123-e92d-43a3-99b5-9ef90aeda173.png
  Captured: 2026-10-28 00:47:18 UTC
  Source report: https://radar.cloudflare.com/scan/377a3123-e92d-43a3-99b5-9ef90aeda173
  SHA-256: a5db7ab655d3900bfb2bf44f8483ca7ce06fc6f795376f14b777be50f1f0af62

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-28T00:55:30Z",
        "uuid": "019f5d06-ec7d-7518-ab08-4adab6f252ea",
        "scanned_at": "2026-07-13T19:49:27Z",
        "final_url": "https://giyilmiscorap.com/",
        "globals": [
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass",
            "reloadButtonClick",
            "downloadButtonClick",
            "detailsButtonClick",
            "setAutoFetchState"
        ],
        "domain_age_days": 2203,
        "apex_age_days": 2203,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -6,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-28T00:50:46Z",
        "uuid": "377a3123-e92d-43a3-99b5-9ef90aeda173",
        "scanned_at": "2026-10-28T00:47:18Z",
        "final_url": "https://giyilmiscorap.com/",
        "history": [
            {
                "url": "https://giyilmiscorap.com/",
                "status": 0
            }
        ],
        "dom_hash": "98bd88916dd950b8235aa4ffd9739350aff34af92069b19d70ec650951d9da5d",
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "giyilmiscorap.com",
                "type": "A",
                "value": "162.4.84.255"
            }
        ],
        "dnssec_valid": false,
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Realtime Register B.V.",
            "created": "2025-10-21T15:48:34Z",
            "updated": "2026-10-22T08:31:08Z",
            "expires": "2027-10-21T15:48:34Z",
            "nameservers": [
                "ns1.rr585.parklogic.com",
                "ns2.rr585.parklogic.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T00:46:24Z",
        "analysis_at": "2026-10-27T13:24:26Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 12,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "popularity": {
            "Alexa": 455593,
            "Statvoo": 455593
        },
        "created": "2025-10-21T00:00:00Z",
        "updated": "2025-10-21T00:00:00Z",
        "first_seen": "2025-10-24T16:06:20Z",
        "dns": [
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.parklogic.com"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.parklogic.com",
                "value": "ns1.parklogic.com"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.parklogic.com"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "v=spf1 -all"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "162.4.84.255"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "mx156.hostedmxserver.com",
                "priority": 10
            }
        ],
        "dns_at": "2026-10-27T13:29:51Z",
        "jarm": "27d40d40d00040d00042d43d0000007d20e9b9a3e87aa1ec17cb4d646ce9a5",
        "cert": {
            "san": [
                "giyilmiscorap.com"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6746d0fb14a275864d8667861b428a8979e",
            "sha256": "723bc22cab7f895aded6ce3d39433682dfbc9cc46cdd29a14cf46bb9a3fb094a",
            "subject": "giyilmiscorap.com",
            "valid_to": "2027-01-19T23:30:26Z",
            "valid_from": "2026-10-21T23:30:27Z"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "pending delete"
            ],
            "events": {
                "expiration": "2026-10-21T15:48:34Z",
                "last changed": "2026-10-21T16:00:21Z",
                "registration": "2025-10-21T15:48:34Z",
                "registrar expiration": "2026-10-21T15:48:34Z",
                "last update of RDAP database": "2026-10-27T13:29:51Z"
            },
            "registrar": "REALTIME REGISTER B.V.",
            "registrar_iana_id": "839"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-28T00:51:03Z",
        "mail_config": {
            "mx": [
                "mx156.hostedmxserver.com"
            ],
            "spf": "v=spf1 -all",
            "spf_lookups": 0
        },
        "caa_records": {
            "count": 1,
            "domain": "giyilmiscorap.com",
            "issuers": [
                "letsencrypt.org"
            ]
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2019-09-17T17:33:35Z",
            "first": "2010-12-09T14:16:34Z",
            "changes": 53,
            "days_archived": 71,
            "scans_per_day": 0.02,
            "avg_page_bytes": 4160
        },
        "trackers": {
            "requests": 2
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": false,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.4.84.46",
                    "host": "ns2.parklogic.com"
                },
                {
                    "ip": "162.4.84.45",
                    "host": "ns1.parklogic.com"
                }
            ],
            "zone": "giyilmiscorap.com"
        },
        "location": {
            "ip": "162.4.84.255",
            "asn": "154653",
            "org": "ParkLogic Pty Ltd",
            "country": "AU"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "giyilmiscorap.com"
        },
        "dns": {
            "A": [
                "162.4.84.255"
            ],
            "MX": [
                "{\"exchange\": \"mx156.hostedmxserver.com\", \"priority\": 10}"
            ],
            "NS": [
                "ns2.parklogic.com",
                "ns1.parklogic.com"
            ],
            "SOA": "{\"nsname\": \"ns1.parklogic.com\", \"hostmaster\": \"hostmaster.parklogic.com\", \"serial\": 1, \"refresh\": 86400, \"retry\": 7200, \"expire\": 1209600, \"minttl\": 300}",
            "TXT": [
                "v=spf1 -all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "162.4.84.255",
            "family": 4
        },
        "subdomains": {
            "count": 11,
            "subdomains": [
                "autodiscover.giyilmiscorap.com",
                "cpanel.giyilmiscorap.com",
                "cpcalendars.giyilmiscorap.com",
                "cpcontacts.giyilmiscorap.com",
                "magento.giyilmiscorap.com",
                "staging.giyilmiscorap.com",
                "store.giyilmiscorap.com",
                "webdisk.giyilmiscorap.com",
                "webmail.giyilmiscorap.com",
                "ww1.giyilmiscorap.com",
                "www.giyilmiscorap.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Nginx",
                "OpenResty"
            ]
        },
        "whois": {
            "registrar": "Realtime Register B.V.",
            "created": "2025-10-21T15:48:34Z",
            "updated": "2026-10-22T08:31:08Z",
            "expires": "2027-10-21T15:48:34Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.rr585.parklogic.com",
                "ns2.rr585.parklogic.com"
            ]
        }
    }
}
```