# PhishDestroy domain threat record: greenfmradio.co.tz

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/greenfmradio.co.tz/
Machine-readable companion: https://phishdestroy.io/domain/greenfmradio.co.tz/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-14 19:33:46 UTC
- Last availability or vendor check: 2026-10-22 10:28:33 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 12/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: spectrum

## Stored infrastructure

- Observed IP address: 108.178.26.90
- Registrar in stored WHOIS data: REG-MOINFOTECH
- Last stored HTTP status: 200
- Registration date (registry RDAP, co.tz): 2009-07-22 08:55:32 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a13bfc-0cd0-769f-8553-f30556ec1361/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/greenfmradio.co.tz
- Certificate Transparency search: https://crt.sh/?q=%25.greenfmradio.co.tz
- Web Archive lookup: https://web.archive.org/web/*/https://greenfmradio.co.tz/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
greenfmradio.co.tz is an impersonation phishing page that poses as Spectrum, the US internet, TV and mobile provider, and targets Spectrum customers. PhishDestroy first saw it on 2026-10-14. As of 2026-10-19 the site was still online and serving its phishing content.

How the scam works
Pages like this copy the look of a trusted provider's sign-in or billing screen. Victims usually arrive through a text message or email warning of an account, payment or service problem. Whatever the victim types, such as a username, password, card number or personal details, goes straight to the operators. They can then take over the account, commit card fraud or reuse the stolen password on other services. The page title reads "One moment, please...", a generic loading message, while scanners identified Spectrum branding on the page and it is classified as Spectrum impersonation.

Evidence
On 2026-10-18, VirusTotal showed 12 of 92 engines flagging the domain. Among them were alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safe Browsing, Gridinsoft and LevelBlue. Google Safe Browsing lists it under SOCIAL_ENGINEERING, its category for phishing and deceptive sites. urlscan.io rated the page malicious and detected the Spectrum brand. The domain is also on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2026-07-20 through REG-MOINFOTECH, less than three months before PhishDestroy detected it. It resolves to 108.178.26.90 on the SINGLEHOP-LLC network operated by Internap Holding LLC in the United States. The site uses a TLS certificate issued by Let's Encrypt (YR2), so the padlock in the browser says nothing about whether it is legitimate.

What to do
If you opened this page, close it and do not return. To reach Spectrum, type the official address yourself or use the official app. If you entered your Spectrum login, change the password right away and enable two-step verification. Change the same password anywhere else you used it. If you entered card or bank details, call your card issuer to block the card and watch your statements for charges you don't recognise. Security teams should block the domain and its IP at the DNS, proxy and email gateway, look in logs for users who visited it, and report it to the hosting provider and registrar for takedown.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a13bfc-0cd0-769f-8553-f30556ec1361/
VirusTotal report: https://www.virustotal.com/gui/domain/greenfmradio.co.tz
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=greenfmradio.co.tz
Archived copy: https://web.archive.org/web/20261014194758/https://greenfmradio.co.tz/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:23:11 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a13bfc-0cd0-769f-8553-f30556ec1361.png
  Captured: 2026-10-14 19:57:38 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a13bfc-0cd0-769f-8553-f30556ec1361.png
  Captured: 2026-10-14 19:57:38 UTC
  Source report: https://urlscan.io/result/01a13bfc-0cd0-769f-8553-f30556ec1361/
- URLScan capture 2: https://urlscan.io/screenshots/01a139a0-cc67-7234-8623-8f1f40ba749a.png
  Captured: 2026-10-14 19:33:46 UTC
  Source report: https://urlscan.io/result/01a13bfc-0cd0-769f-8553-f30556ec1361/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3e9584ef-244b-42cd-be88-3726acebff27.png
  Captured: 2026-10-14 19:34:58 UTC
  Source report: https://radar.cloudflare.com/scan/3e9584ef-244b-42cd-be88-3726acebff27
  SHA-256: c42bfb5da757dafdfa78da591060436d50e13b2992346cd40cd5887fcf81482e
- URLScan · 2026-10-13: https://screenshots.phishdestroy.io/us/01a13636-8950-73e6-ae54-7cdf34eac0d0.png
  Captured: 2026-10-13 17:01:56 UTC
  Source report: https://urlscan.io/result/01a13636-8950-73e6-ae54-7cdf34eac0d0/
  SHA-256: dc46eccae45470fcb85b0bd5a34ed08612211a13378547d556f4fcd84ddfe0b9
- URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a13a85-ec07-749a-a126-fb3f133f99ac.png
  Captured: 2026-10-14 13:07:07 UTC
  Source report: https://urlscan.io/result/01a13a85-ec07-749a-a126-fb3f133f99ac/
  SHA-256: de6fb93fb6e0884fcddf15380a39bfdc100f5f79b7111185dd5f2395695a6f4f
- URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a13b5e-2b2d-77f4-82e8-813031ad7234.png
  Captured: 2026-10-14 17:03:31 UTC
  Source report: https://urlscan.io/result/01a13b5e-2b2d-77f4-82e8-813031ad7234/
  SHA-256: de6fb93fb6e0884fcddf15380a39bfdc100f5f79b7111185dd5f2395695a6f4f
- URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a13c04-3f44-70fc-bb78-30a810b667a4.png
  Captured: 2026-10-14 20:04:43 UTC
  Source report: https://urlscan.io/result/01a13c04-3f44-70fc-bb78-30a810b667a4/
  SHA-256: ce84e7fc0e7974537c35715dc89b8a6db11fbec9c654db7a52979178c09650a4
- URLScan · 2026-10-15: https://screenshots.phishdestroy.io/us/01a14030-5056-73cd-ae65-c154be8598cb.png
  Captured: 2026-10-15 15:31:22 UTC
  Source report: https://urlscan.io/result/01a14030-5056-73cd-ae65-c154be8598cb/
  SHA-256: de6fb93fb6e0884fcddf15380a39bfdc100f5f79b7111185dd5f2395695a6f4f
- URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a15959-a398-703f-81a3-397e2555723f.png
  Captured: 2026-10-20 12:47:05 UTC
  Source report: https://urlscan.io/result/01a15959-a398-703f-81a3-397e2555723f/
  SHA-256: de6fb93fb6e0884fcddf15380a39bfdc100f5f79b7111185dd5f2395695a6f4f

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:47:59Z",
        "uuid": "01a13bfc-0cd0-769f-8553-f30556ec1361",
        "scanned_at": "2026-10-14T19:55:43Z",
        "final_url": "https://jaymarutidada.com/yingin/",
        "status": 200,
        "redirected": "off-domain",
        "redirects": [
            {
                "to": "https://greenfmradio.co.tz/setup",
                "from": "http://greenfmradio.co.tz/setup",
                "status": 307
            },
            {
                "to": "https://greenfmradio.co.tz/setup/",
                "from": "https://greenfmradio.co.tz/setup",
                "status": 301
            },
            {
                "to": "https://jaymarutidada.com/yingin/",
                "from": "https://greenfmradio.co.tz/setup/"
            }
        ],
        "ip": "207.174.212.247",
        "ptr": "207-174-212-247.unifiedlayer.com",
        "domains": [
            "greenfmradio.co.tz",
            "cdnjs.cloudflare.com"
        ],
        "ips": [
            "104.17.24.14",
            "207.174.212.247",
            "108.178.26.90"
        ],
        "asns": [
            "13335",
            "46606",
            "32475"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "id.spectrum.net",
            "www.spectrum.com",
            "spectrum.com",
            "www.spectrum.net"
        ],
        "doc_hash": "6a869de1cb52e053db52062cc4abf3c2b64f43d4078efa2a2845e33bc5229d58",
        "globals": [
            "$",
            "jQuery",
            "$jscomp"
        ],
        "tls": {
            "san": [
                "*.greenfmradio.co.tz",
                "greenfmradio.co.tz"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "greenfmradio.co.tz",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-18T13:50:54Z",
            "valid_from": "2026-09-19T13:50:55Z"
        },
        "domain_age_days": 2688,
        "apex_age_days": 2688,
        "tls_age_days": 21,
        "tls_valid_days": 89,
        "requests": 7,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "spectrum"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Spectrum"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:00:42Z",
        "uuid": "3e9584ef-244b-42cd-be88-3726acebff27",
        "scanned_at": "2026-10-14T19:34:58Z",
        "final_url": "https://greenfmradio.co.tz/",
        "status": 200,
        "history": [
            {
                "url": "https://greenfmradio.co.tz/",
                "status": 200
            }
        ],
        "dom_hash": "d3b0c18fe3cb93650a6b55841b27f9b650d6678c40d65ec8784e8b2525172331",
        "doc_hash": "5f1239b8f2be8d95c423fa4b41cde3149a775392fa7d2c05a8cc653db4992c72",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "greenfmradio.co.tz",
                "type": "A",
                "value": "108.178.26.90"
            }
        ],
        "dnssec_valid": false,
        "ip": "108.178.26.90",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "REG-MOINFOTECH",
            "created": "2026-07-20T12:20:57Z",
            "expires": "2027-07-20T00:00:00Z",
            "nameservers": [
                "ns55.superdnssite.com",
                "ns56.superdnssite.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T21:12:08Z",
        "analysis_at": "2026-10-18T02:00:08Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 12,
            "suspicious": 0,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "LevelBlue": "phishing",
            "Gridinsoft": "phishing",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "REG-MOINFOTECH",
        "first_seen": "2026-09-19T16:13:02Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.moinfo.co.tz"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:108.178.26.90 ~all"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.moinfo.co.tz"
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "108.178.26.90"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "kibahaonline.gmail.com",
                "value": "ns1.moinfo.co.tz"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "greenfmradio.co.tz",
                "priority": 0
            }
        ],
        "dns_at": "2026-10-18T02:00:27Z",
        "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b",
        "cert": {
            "san": [
                "*.greenfmradio.co.tz",
                "greenfmradio.co.tz"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "62ce98675f4f68a72d08e6983d7aa4347d7",
            "sha256": "eda21214892c28157479f7a2e1f668bdffa867feb3895509233acd0cc83e6c64",
            "subject": "greenfmradio.co.tz",
            "valid_to": "2026-12-18T13:50:54Z",
            "valid_from": "2026-09-19T13:50:55Z"
        },
        "whois": {
            "registrar": "REG-MOINFOTECH"
        }
    }
}
```