# PhishDestroy domain threat record: growthfunnels.com.au

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/growthfunnels.com.au/
Machine-readable companion: https://phishdestroy.io/domain/growthfunnels.com.au/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 23:29:36 UTC
- Last availability or vendor check: 2026-10-22 10:28:37 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: across

## Stored infrastructure

- Observed IP address: 216.198.79.1
- Registrar in stored WHOIS data: GoDaddy.com LLC trading as GoDaddy.com
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a12825-0257-77b4-aa54-bd31f60e1085/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/growthfunnels.com.au
- Certificate Transparency search: https://crt.sh/?q=%25.growthfunnels.com.au
- Web Archive lookup: https://web.archive.org/web/*/https://growthfunnels.com.au/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
growthfunnels.com.au presents itself as "Growth Funnels | Lead Generation & Automation Agency Melbourne" and is classified by PhishDestroy as an impersonation phishing page. That title describes a legitimate-sounding marketing agency, while our classification is impersonation phishing. The audience is small businesses and marketers looking for lead generation or automation services. PhishDestroy first flagged the domain on 2026-10-11, and the site was still online with live content on 2026-10-19.

How the scam works
Impersonation pages borrow the name, look and positioning of a real business so visitors drop their guard. A page dressed as a Melbourne marketing agency can push contact forms, client portals, invoice links or login prompts that harvest names, business emails, passwords and payment details. Anyone who trusts the branding may hand over account credentials or pay for services that never arrive. Stolen business logins are often reused to reach email, ad accounts or CRM tools.

Evidence
Six of 92 VirusTotal engines flagged the domain as of 2026-10-16: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft and SOCRadar. That is a modest count, but the six vendors reached their verdicts independently. The domain also appears in 34 AlienVault OTX threat pulses, which shows that other researchers have tracked it. Among the blocklists covered here, only PhishDestroy currently lists it, so many browsers and filters may still let it load without a warning.

Infrastructure
The domain is registered through GoDaddy.com LLC and resolves to 216.198.79.1 on Amazon's AMAZON-02 network in the US. Mainstream cloud hosting lets a page like this look as reliable as any genuine small-business site. Its certificate comes from Let's Encrypt (YR2), which is free and automatic, so the padlock only means the connection is encrypted. It says nothing about who runs the site.

What to do
If you filled in a form or logged in on growthfunnels.com.au, change that password right away. Change it anywhere else you reuse it, and turn on two-factor authentication for your email and business accounts. If you paid an invoice or entered card details, contact your bank to dispute the charge and watch for follow-up phishing sent to the email you gave. Before engaging a marketing agency, confirm its contact details through an independent source. Security teams should block the domain and its IP at the DNS and proxy level, and check mail and web logs for users who visited it after 2026-10-11.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a12825-0257-77b4-aa54-bd31f60e1085/
VirusTotal report: https://www.virustotal.com/gui/domain/growthfunnels.com.au
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=growthfunnels.com.au
Archived copy: https://web.archive.org/web/20261010233113/https://growthfunnels.com.au/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:27:09 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/KzXCSFRY/16572a4190e3.png
  Captured: 2026-10-10 23:29:36 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a12825-0257-77b4-aa54-bd31f60e1085.png
  Captured: 2026-10-10 23:29:36 UTC
  Source report: https://urlscan.io/result/01a12825-0257-77b4-aa54-bd31f60e1085/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/204b0166-02e1-406f-b23c-c5c879f0e5b9.png
  Captured: 2026-10-12 11:13:27 UTC
  Source report: https://radar.cloudflare.com/scan/204b0166-02e1-406f-b23c-c5c879f0e5b9
  SHA-256: a52ecbc791234122f31371b598e9bf451e0ccf424a08dfecf20c93ae69b5d731

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:33:01Z",
        "uuid": "01a12825-0257-77b4-aa54-bd31f60e1085",
        "scanned_at": "2026-10-10T23:28:04Z",
        "final_url": "https://growthfunnels.com.au/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://growthfunnels.com.au/",
                "from": "http://growthfunnels.com.au/",
                "status": 307
            }
        ],
        "ip": "216.198.79.1",
        "domains": [
            "www.youtube.com",
            "jnn-pa.googleapis.com",
            "googleads.g.doubleclick.net",
            "www.google.com",
            "analytics.ahrefs.com",
            "connect.facebook.net",
            "www.googletagmanager.com",
            "fonts.gstatic.com",
            "track-ap1.hubspot.com",
            "api-ap1.hubapi.com",
            "forms-ap1.hscollectedforms.net",
            "www.gstatic.com",
            "yt3.ggpht.com",
            "i.ytimg.com",
            "js-ap1.hsadspixel.net",
            "js-ap1.hs-analytics.net",
            "js-ap1.hscollectedforms.net",
            "js-ap1.hs-banner.com",
            "static.doubleclick.net",
            "stats.g.doubleclick.net",
            "analytics.google.com",
            "amplify.outbrain.com",
            "www.clarity.ms",
            "js-ap1.hs-scripts.com",
            "scale.growthfunnels.com.au"
        ],
        "ips": [
            "104.17.92.187",
            "104.16.53.78",
            "172.217.112.4",
            "142.251.13.94",
            "142.251.13.132",
            "142.251.127.119",
            "104.17.128.172",
            "104.17.175.201",
            "104.16.108.254",
            "172.64.147.16",
            "142.251.152.119",
            "142.251.127.148",
            "142.250.154.155",
            "142.251.127.154",
            "216.239.34.181"
        ],
        "asns": [
            "13335",
            "15169",
            "16625",
            "8075",
            "32934",
            "16509"
        ],
        "countries": [
            "US",
            "DE",
            "CH"
        ],
        "doc_hash": "57a95052827441998dc68a0f9180f7dfd2812d7c1c21adfc95608b11e41221bc",
        "script_hashes": [
            "1410ba41fcc5a9e51e6dd2589558e0ce4c374b43315ce5889f3647b385da7494",
            "9666cd6a3c3b9cc1e7a1e8e79c06d690d4fc147431805af4e6c25fa94f28e8e1",
            "de1433d29680cd847ad2acbf5d4db433b5dbba055fce5426b88f7ad132ac1f4d",
            "afe0ac318c603d1a3b2a7823678bdfce5567dade0d3f5df64e680c5c952d12a9",
            "ce289f44765094b0442c0215d8c939926baa4f687dd04ff3299a54e259412746",
            "905b27fe825522a9d949e34d84d6cee9c45618bf871f0ab1eafd5cf7bf59092c",
            "67ee0f32b353faaf3d73f24082264d73ad2398e58ac2b2b250ece0290dabc2f2",
            "10edf4c8441d84ac95c0c6a8e7e613267f119f28e6231f03656ae9df133759c5",
            "1f7f555245b9b9032caa3605244e2a152f4af3ca690bbfd9904839e98d4d6c32",
            "c56fd7fedc232d87c69868b8452770cc2cd21c15252e1c6624de59e89641c578"
        ],
        "globals": [
            "__next_f",
            "TURBOPACK",
            "next",
            "__webpack_hash__",
            "_N_E_STYLE_LOAD",
            "MotionIsMounted",
            "dataLayer",
            "google_tag_data",
            "google_tag_manager",
            "fbq",
            "_fbq",
            "clarity",
            "obApi",
            "ahrefs_analytics_script",
            "onYouTubeIframeAPIReady",
            "AhrefsAnalytics",
            "obtpeuZone1",
            "scriptUrl",
            "ttPolicy",
            "YT",
            "YTConfig",
            "onYTReady",
            "gaGlobal",
            "_hsp",
            "__hsReferrer",
            "__hsInitialUrl",
            "PIXELS_RAN",
            "enabledEventSettings",
            "_hsq",
            "__hsCollectedFormsDebug",
            "sanitizeKey",
            "_hstc_loaded",
            "hsCookieBanner",
            "_hspb_loaded",
            "_hspb_ran",
            "_hstc_ran",
            "hsCallsToActionsReady",
            "__hsUserToken",
            "expireDateTime"
        ],
        "cookies": [
            "__cf_bm",
            "YSC",
            "VISITOR_INFO1_LIVE",
            "VISITOR_PRIVACY_METADATA",
            "__Secure-YNID",
            "__Secure-ROLLOUT_TOKEN",
            "_gcl_au",
            "_ga_PCKP8L8DGZ",
            "_ga",
            "_fbp",
            "__hstc",
            "hubspotutk",
            "__hssrc",
            "__hssc"
        ],
        "storage_keys": [
            "_gcl_ls",
            "lastExternalReferrer",
            "lastExternalReferrerTime"
        ],
        "tls": {
            "san": [
                "growthfunnels.com.au"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "growthfunnels.com.au",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-17T02:47:34Z",
            "valid_from": "2026-08-19T02:47:35Z"
        },
        "domain_age_days": 3561,
        "apex_age_days": 3561,
        "tls_age_days": 52,
        "tls_valid_days": 89,
        "requests": 83,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -97,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Vercel",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=63072000",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:44:26Z",
        "uuid": "204b0166-02e1-406f-b23c-c5c879f0e5b9",
        "scanned_at": "2026-10-12T11:13:27Z",
        "final_url": "https://growthfunnels.com.au/",
        "status": 200,
        "history": [
            {
                "url": "https://growthfunnels.com.au/",
                "status": 200
            }
        ],
        "dom_hash": "f676c7c7955f188e788b9e18fa61595f017d47c2dab30a9cc1e9056c1be7f0d0",
        "doc_hash": "57a95052827441998dc68a0f9180f7dfd2812d7c1c21adfc95608b11e41221bc",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "growthfunnels.com.au",
                "type": "A",
                "value": "216.198.79.1"
            }
        ],
        "dnssec_valid": false,
        "ip": "216.198.79.1",
        "whois": {
            "registrar": "GoDaddy.com LLC trading as GoDaddy.com",
            "updated": "2026-08-15T20:02:05Z",
            "nameservers": [
                "leo.ns.cloudflare.com",
                "wren.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T02:38:01Z",
        "analysis_at": "2026-10-20T16:03:53Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 36
        },
        "reputation": 0,
        "first_seen": "2023-10-05T12:48:36Z",
        "dns": [
            {
                "ttl": 300,
                "type": "MX",
                "value": "ASPMX.L.GOOGLE.com",
                "priority": 1
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "leo.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "wren.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "ALT3.ASPMX.L.GOOGLE.com",
                "priority": 10
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:27.121.68.106 include:_spf.google.com include:spf.mysecurecloudhost.com ~all"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "ALT4.ASPMX.L.GOOGLE.com",
                "priority": 10
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "leo.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "216.198.79.1"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "ALT1.ASPMX.L.GOOGLE.com",
                "priority": 5
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "google-site-verification=KK0L4_hnTlMnkjAz3IFfAabSXq3HON417uA8ENzRbiE"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "ALT2.ASPMX.L.GOOGLE.com",
                "priority": 5
            }
        ],
        "dns_at": "2026-10-20T16:06:29Z",
        "jarm": "3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fb",
        "cert": {
            "san": [
                "growthfunnels.com.au"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "68343a22a67edef0a7bd8e77ee800f8621a",
            "sha256": "c48f411d9c27d37b6974eea95ab41124de19d19748a4ebdd4709e0bf9dc63a5e",
            "subject": "growthfunnels.com.au",
            "valid_to": "2027-01-17T17:30:06Z",
            "valid_from": "2026-10-19T17:30:07Z"
        },
        "whois": {
            "registrar_url": "https://www.godaddy.com/en-au/contact-us",
            "nameservers": [
                "leo.ns.cloudflare.com",
                "wren.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```