# PhishDestroy domain threat record: gleam-mentor.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/gleam-mentor.com/
Machine-readable companion: https://phishdestroy.io/domain/gleam-mentor.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 21:18:59 UTC
- Last availability or vendor check: 2026-10-27 23:00:25 UTC
- Stored record updated: 2026-10-27 23:30:54 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.97.1
- Registrar in stored WHOIS data: Porkbun LLC
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2025-11-18 07:51:22 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019ddd59-9144-715d-8064-afc5c70056e6/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/gleam-mentor.com
- Certificate Transparency search: https://crt.sh/?q=%25.gleam-mentor.com
- Web Archive lookup: https://web.archive.org/web/*/https://gleam-mentor.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added gleam-mentor.com to its blocklist on 2026-10-27 based on a trusted auto rule that flags domains older than 300 days. The domain was first seen by PhishDestroy on that same date. A direct HTTP fetch on 2026-10-27 returned a 403 status code, indicating the page was not publicly accessible at that moment. Earlier scans by urlscan on 2026-04-30 captured a successful HTTPS response with a 200 status but did not reveal a page title.

How the scam works
The detections suggest the site may be used for phishing or malware distribution, a common pattern where attackers host deceptive pages to harvest credentials or deliver malicious payloads. Without concrete evidence of a specific scheme on this domain, the risk remains that visitors could be tricked into providing personal information or downloading harmful content. Such domains typically rely on brand impersonation or fake offers to lure users, but no particular brand or offer is confirmed for gleam-mentor.com.

Evidence
VirusTotal analyzed the domain on 2026-10-27 and reported 16 detections from 92 engines, including 14 malicious and 2 suspicious labels from vendors such as BitDefender, ESET, and Forcepoint ThreatSeeker. Google Safe Browsing checked on 2026-10-27 and did not flag the domain. PhishDestroy’s internal blocklist marks the domain as malicious. OTX listed one pulse referencing the domain on the same date. urlscan’s engine score was 98 (malicious) on 2026-04-30, though its overall verdict was non‑malicious. Cloudflare Radar on 2026-10-27 classified the site as phishing and malware.

Infrastructure
The domain was registered with Porkbun LLC on 2025-11-18, making it 343 days old at first detection. DNS records point to Cloudflare’s network, with IPv4 188.114.97.1 and IPv6 2a06:98c1:3120::3, both associated with Cloudflare, Inc. in the United States. TLS certificates issued by Google Trust Services were observed, valid from early 2026 for 90 days. No DNSSEC records were present.

What to do
If you visited gleam-mentor.com and entered any credentials, change those passwords immediately and enable multi‑factor authentication where possible. Monitor financial and personal accounts for unexpected activity. For security teams, add gleam-mentor.com to web filtering and intrusion‑detection rules, and log any DNS queries to this domain for further investigation.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019ddd59-9144-715d-8064-afc5c70056e6/
Cloudflare Radar report: https://radar.cloudflare.com/scan/3238fb4c-50ee-4ad2-b38e-461b8b06c1c8
Stored capture screenshot: https://urlscan.io/screenshots/019ddd59-9144-715d-8064-afc5c70056e6.png
Cloudflare Radar screenshot (2026-10-27T21:21:34Z): https://screenshots.phishdestroy.io/cf/3238fb4c-50ee-4ad2-b38e-461b8b06c1c8.png
URLScan screenshot (2026-04-29T03:30:51Z): https://screenshots.phishdestroy.io/us/019dd74a-0202-719d-b458-442b042242b9.png
URLScan capture report: https://urlscan.io/result/019dd74a-0202-719d-b458-442b042242b9/
URLScan screenshot (2026-04-29T07:40:41Z): https://screenshots.phishdestroy.io/us/019dd82e-bfa6-72ce-ac80-63831c4cb39d.png
URLScan capture report: https://urlscan.io/result/019dd82e-bfa6-72ce-ac80-63831c4cb39d/
VirusTotal report: https://www.virustotal.com/gui/domain/gleam-mentor.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gleam-mentor.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 21:24:57 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019ddd59-9144-715d-8064-afc5c70056e6.png
  Captured: 2026-10-27 21:18:59 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/019ddd59-9144-715d-8064-afc5c70056e6.png
  Source report: https://urlscan.io/result/019ddd59-9144-715d-8064-afc5c70056e6/
- URLScan · 2026-04-29: https://screenshots.phishdestroy.io/us/019dd74a-0202-719d-b458-442b042242b9.png
  Captured: 2026-04-29 03:30:51 UTC
  Source report: https://urlscan.io/result/019dd74a-0202-719d-b458-442b042242b9/
  SHA-256: 8fe8bd6f0d4e35a00c41fd3c55785ecbf6be8214e818da7057c266dbb8ac6dae
- URLScan · 2026-04-29: https://screenshots.phishdestroy.io/us/019dd82e-bfa6-72ce-ac80-63831c4cb39d.png
  Captured: 2026-04-29 07:40:41 UTC
  Source report: https://urlscan.io/result/019dd82e-bfa6-72ce-ac80-63831c4cb39d/
  SHA-256: 8fe8bd6f0d4e35a00c41fd3c55785ecbf6be8214e818da7057c266dbb8ac6dae
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3238fb4c-50ee-4ad2-b38e-461b8b06c1c8.png
  Captured: 2026-10-27 21:21:34 UTC
  Source report: https://radar.cloudflare.com/scan/3238fb4c-50ee-4ad2-b38e-461b8b06c1c8
  SHA-256: c92527a69aa3fcebe780fb0d114e03d6a626390234da8bc5086dbbd206c8b559

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T21:24:21Z",
        "uuid": "019ddd59-9144-715d-8064-afc5c70056e6",
        "scanned_at": "2026-04-30T07:45:33Z",
        "final_url": "https://gleam-mentor.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://gleam-mentor.com/",
                "from": "http://gleam-mentor.com/",
                "status": 307
            }
        ],
        "ip": "2a06:98c1:3120::3",
        "ips": [
            "2a06:98c1:3120::3"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "0159f3337cbed0e174ad61a7ad1e54d9aa92928f6b5cb3aa900a459497089668",
        "script_hashes": [
            "df87eab8f1eebc9dec902c576ca66dc9a269b4c39099cce8960c1ab2ebadceba",
            "f5c0d7df3136feeaccc8d3a35b4e1e1f6740364fed66d7e5a7e5473adf7ae997",
            "c00469adcee1aad554c622325d9891174123ca37c7af3e61be04175121ca6eb7",
            "5c7145bd683c604e00afd4fc3df68eda9da1bb863cd9ea574be62ca7f5f3f3fc",
            "f10414d6bd6b3d91fee2cb284ffa7e9e0201bc95f4526a90d7819013fa79db66",
            "d597dc1d9575b82dd78f84b1bc4327fe5e8c96d7718ada88b7b0553c287fbe5f",
            "f2810f184af8974e2f72fb0152312ce6550133c063daf6aac1feafc07eb25140",
            "ccc5d665823e48c20d88a72fcd39c0a2a69055e03357b98f2d0fc50d3baf75aa"
        ],
        "globals": [
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_SSR_SETTERS__",
            "__buildAssetsURL",
            "__publicAssetsURL",
            "$fetch",
            "global",
            "__unctx__",
            "__unctx_async_handlers__",
            "__VUE__",
            "useNuxtApp"
        ],
        "cookies": [
            "surfer_uuid"
        ],
        "tls": {
            "san": [
                "gleam-mentor.com",
                "*.gleam-mentor.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "gleam-mentor.com",
            "protocol": "QUIC",
            "valid_to": "2026-06-16T16:44:12Z",
            "valid_from": "2026-03-18T15:45:40Z"
        },
        "domain_age_days": 162,
        "apex_age_days": 162,
        "tls_age_days": 42,
        "tls_valid_days": 90,
        "requests": 13,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T21:24:23Z",
        "uuid": "3238fb4c-50ee-4ad2-b38e-461b8b06c1c8",
        "scanned_at": "2026-10-27T21:21:34Z",
        "final_url": "https://gleam-mentor.com/",
        "status": 200,
        "history": [
            {
                "url": "https://gleam-mentor.com/",
                "status": 200
            }
        ],
        "dom_hash": "6f581d7a067e4f4d9088edf3075d62ff1b2167feb916c0b5981aeb51a3f34d74",
        "doc_hash": "979f6f9ee5de96eefdcf9bf6063ee9700527b0346dc92dac12984d81643e4679",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "gleam-mentor.com",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "gleam-mentor.com",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "gleam-mentor.com",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            },
            {
                "name": "gleam-mentor.com",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.11",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Porkbun LLC",
            "created": "2025-11-18T08:51:22Z",
            "updated": "2025-11-20T08:10:24Z",
            "expires": "2026-11-18T08:51:22Z",
            "nameservers": [
                "ainsley.ns.cloudflare.com",
                "benedict.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T21:20:04Z",
        "analysis_at": "2026-10-27T13:24:41Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 14,
            "suspicious": 2,
            "undetected": 31
        },
        "detections": {
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": -7,
        "votes": {
            "malicious": 1
        },
        "created": "2025-11-18T00:00:00Z",
        "updated": "2025-11-18T00:00:00Z",
        "first_seen": "2025-11-20T08:28:04Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ainsley.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "benedict.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "ainsley.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.16.99"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:1063"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:a739"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.167.57"
            }
        ],
        "dns_at": "2026-10-27T13:29:57Z",
        "jarm": "27d40d40d00040d1dc27d40d27d40d5fb4c89fe3813d172ffb53f84a68f750",
        "cert": {
            "san": [
                "gleam-mentor.com",
                "*.gleam-mentor.com"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "2504de734e14958d13461ae653ac1d2",
            "sha256": "23372c2c16c5396090f4f6cd52d99d7fe8fb60a930d257064a8b68fd060cae48",
            "subject": "gleam-mentor.com",
            "valid_to": "2026-12-11T08:35:52Z",
            "valid_from": "2026-09-12T07:36:05Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "delete prohibited",
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2026-11-18T08:51:22Z",
                "last changed": "2025-11-18T08:51:22Z",
                "registration": "2025-11-18T08:51:22Z",
                "registrar expiration": "2026-11-18T08:51:22Z",
                "last update of RDAP database": "2025-11-18T08:51:22Z"
            },
            "registrar": "Porkbun LLC",
            "registrar_iana_id": "1861"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T21:24:39Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "gleam-mentor.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-27T21:22:24Z",
            "first": "2026-10-27T21:22:24Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 3081
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "social_tags": {
            "themeColor": "#ffffff"
        },
        "trackers": {
            "requests": 10
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 9,
                "tls": 38,
                "wait": 140,
                "connect": 7,
                "download": 0
            },
            "response_ms": 194
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "ECDHE-ECDSA-AES128-GCM-SHA256",
            "protocol": "TLSv1.2",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 4138,
            "co2_grams": 0.0002,
            "cleaner_than": 91
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.211",
                    "host": "ainsley.ns.cloudflare.com"
                },
                {
                    "ip": "162.159.44.205",
                    "host": "benedict.ns.cloudflare.com"
                }
            ],
            "zone": "gleam-mentor.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "surfer_uuid"
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3121::3",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Washington",
            "country": "US"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "gleam-mentor.com"
        },
        "dns": {
            "A": [
                "188.114.97.3",
                "188.114.96.3"
            ],
            "NS": [
                "benedict.ns.cloudflare.com",
                "ainsley.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"ainsley.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2414687878, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3121::3",
                "2a06:98c1:3120::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3121::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://gleam-mentor.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Node.js",
                "Envoy",
                "Vue.js",
                "Nuxt.js",
                "Google Font API",
                "Cloudflare",
                "HTTP/3"
            ]
        },
        "whois": {
            "registrar": "Porkbun LLC",
            "created": "2025-11-18T08:51:22Z",
            "updated": "2025-11-20T08:10:24Z",
            "expires": "2026-11-18T08:51:22Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ainsley.ns.cloudflare.com",
                "benedict.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```