# PhishDestroy domain threat record: hairsalon-locco.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/hairsalon-locco.net/
Machine-readable companion: https://phishdestroy.io/domain/hairsalon-locco.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 22:36:48 UTC
- Last availability or vendor check: 2026-10-22 10:36:51 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 7/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 162.43.94.73
- Registrar in stored WHOIS data: XServer, Inc.
- Last stored HTTP status: 200
- Registration date (registry RDAP, hairsalon-locco.net): 2018-12-12 03:23:36 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a127f4-fe26-754e-a4c5-d299e52c9ab5/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/hairsalon-locco.net
- Certificate Transparency search: https://crt.sh/?q=%25.hairsalon-locco.net
- Web Archive lookup: https://web.archive.org/web/*/https://hairsalon-locco.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
hairsalon-locco.net presents itself as the website of Locco (ロッコ), a hair salon in Tsuyama, Okayama Prefecture, Japan. Its page title reads "岡山県津山の美容室・美容院 Locco（ロッコ）". PhishDestroy first saw it on 2026-10-11 and added it to our blocklist. As of 2026-10-19 the site was still online and serving content. The page title shows an ordinary local salon, while PhishDestroy has listed the domain as suspicious.

How the scam works
Nothing on this domain points to a specific scheme, brand impersonation or phishing kit, so we do not assign one. The risk comes from the reputation signals around the domain. When several security engines flag a site that looks like a small-business page, the usual concerns are hidden redirects, injected scripts or pages that ask visitors for logins, payment details or wallet connections. Until that is ruled out, treat any form, download or prompt on this site as untrusted.

Evidence
On 2026-10-16, 7 of 92 VirusTotal engines flagged the domain. The vendors were alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft, Seclookup, SOCRadar, Sophos and URLQuery. That is a minority verdict, but it comes from several unrelated vendors rather than a single engine. The domain also appears in 33 AlienVault OTX threat pulses, which shows that other researchers have been tracking it. Among the blocklists we check, only PhishDestroy lists it.

Infrastructure
The domain was registered on 2018-12-12 through XServer, Inc., almost eight years before PhishDestroy first saw it. Operators of throwaway scam sites rarely keep a domain that long, and that age fits an established local business site. The site is hosted on XServer Cloud Inc. in Japan, which matches the salon's stated location. Its Let's Encrypt certificate only means the connection is encrypted. It says nothing about whether the content is safe.

What to do
If you visited and were redirected elsewhere or prompted to download something, run a full malware scan on that device. If you entered a password on this site or on a page it sent you to, change that password and turn on two-factor authentication wherever you reused it. If you entered card details, ask your bank to watch for fraudulent charges. Defenders should block the domain at the DNS or proxy level and check logs for traffic to it since 2026-10-11. If you know the salon, let them know their site is being flagged so they can check it for unauthorized changes.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a127f4-fe26-754e-a4c5-d299e52c9ab5/
VirusTotal report: https://www.virustotal.com/gui/domain/hairsalon-locco.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=hairsalon-locco.net
Archived copy: https://web.archive.org/web/20261010213450/https://hairsalon-locco.net/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:39:42 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/d1RbsBh/e12f2fc11e4c.png
  Captured: 2026-10-10 22:36:48 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a127f4-fe26-754e-a4c5-d299e52c9ab5.png
  Captured: 2026-10-10 22:36:48 UTC
  Source report: https://urlscan.io/result/01a127f4-fe26-754e-a4c5-d299e52c9ab5/
- URLScan capture 2: https://urlscan.io/screenshots/01a0c19b-92f3-774a-83c6-5cc941bb4a53.png
  Captured: 2026-10-10 21:34:09 UTC
  Source report: https://urlscan.io/result/01a127f4-fe26-754e-a4c5-d299e52c9ab5/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/faab4548-d9fd-4b69-bac8-7dfaefa0851d.png
  Captured: 2026-10-12 11:52:31 UTC
  Source report: https://radar.cloudflare.com/scan/faab4548-d9fd-4b69-bac8-7dfaefa0851d
  SHA-256: f6efce7de922bb63dad9675b5de69b0de6c76195fb61d96363a9f5024c0d5228
- URLQuery: https://screenshots.phishdestroy.io/uq/643540eb-0821-45b6-913f-239e49674d75.png
  Source report: https://urlquery.net/report/643540eb-0821-45b6-913f-239e49674d75
  SHA-256: fba4e5600d6716312eff5e336a292e0384d1ff14bcc4ca6dc2887df5811ccc22
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c19b-92f3-774a-83c6-5cc941bb4a53.png
  Captured: 2026-09-21 01:36:40 UTC
  Source report: https://urlscan.io/result/01a0c19b-92f3-774a-83c6-5cc941bb4a53/
  SHA-256: f3e489d4a7649f91972f37b15a10dddc9b8eccc4d0acc835a4e3c81d570f8c66
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127bd-3120-7519-8796-56f83acf0d75.png
  Captured: 2026-10-10 21:34:42 UTC
  Source report: https://urlscan.io/result/01a127bd-3120-7519-8796-56f83acf0d75/
  SHA-256: 58781638be98a1675b2273336cbf525a977418bf2bcaf9894bb9b3aa2bca728d
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127c7-2592-7589-85a7-95431be2c7a3.png
  Captured: 2026-10-10 21:46:01 UTC
  Source report: https://urlscan.io/result/01a127c7-2592-7589-85a7-95431be2c7a3/
  SHA-256: d815c3e01e3e25fe4a1030797b21f30c3e0ca59af4686406f57e523dc9a8ff36
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127da-eb96-70bb-8e09-08c42e099425.png
  Captured: 2026-10-10 22:07:10 UTC
  Source report: https://urlscan.io/result/01a127da-eb96-70bb-8e09-08c42e099425/
  SHA-256: 58781638be98a1675b2273336cbf525a977418bf2bcaf9894bb9b3aa2bca728d
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127e4-7d5e-7669-9380-961b4ac19b0c.png
  Captured: 2026-10-10 22:17:38 UTC
  Source report: https://urlscan.io/result/01a127e4-7d5e-7669-9380-961b4ac19b0c/
  SHA-256: 58781638be98a1675b2273336cbf525a977418bf2bcaf9894bb9b3aa2bca728d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:33:30Z",
        "uuid": "01a127f4-fe26-754e-a4c5-d299e52c9ab5",
        "scanned_at": "2026-10-10T22:35:43Z",
        "final_url": "https://hairsalon-locco.net/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://hairsalon-locco.net/",
                "from": "http://hairsalon-locco.net/",
                "status": 307
            }
        ],
        "ip": "162.43.94.73",
        "ptr": "sv15072.xserver.jp",
        "domains": [
            "www.google-analytics.com",
            "www.googletagmanager.com",
            "fonts.gstatic.com",
            "ajax.googleapis.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.42.110",
            "142.250.195.227",
            "142.251.222.232",
            "142.250.195.106",
            "142.250.195.138",
            "162.43.94.73"
        ],
        "asns": [
            "15169",
            "131965"
        ],
        "countries": [
            "US",
            "JP"
        ],
        "link_domains": [
            "www.instagram.com",
            "www.facebook.com",
            "line.me",
            "beauty.hotpepper.jp"
        ],
        "social": [
            "https://www.instagram.com/locco.3",
            "https://www.facebook.com/locco0709"
        ],
        "doc_hash": "0552d074e265e380a4f0be7e3593997a7a436931de7ae6e36c17bcacc677dbfb",
        "script_hashes": [
            "d75c4b0005a76448fb265462fd2b4e7f738f01c33053eead092c657e63fcdf71",
            "6414232b68b9798c177c1217cb71a7c6e877bc0abc84d0a1cb3d0aa290b6b23c",
            "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf",
            "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89",
            "a6dee45a457ace81f61de0721f37d5c1a8b88bafc0c6ec788dbe2a816411249a",
            "fc774906082b59dedcfc55b8ef127783b6d056578ff4586a8ebbdb81bbe286f1",
            "5083905862c2b7aa8a84c4f2313d359d2288fb25fbe1ff577fa7325eff2ed2d9",
            "29fdd17a7002a2e1bbd9b33adafc53457c64006b5aca8f6e4dbf907de35433ca",
            "ddcce687729cb358abf9d0d8e1217a097859be2b0d18c23d7c851b38c87bc9c0",
            "8086e81c0cb51fa76fa062ae0466f6e4b2698c54815b0a9aa199b1ddef321031"
        ],
        "globals": [
            "dataLayer",
            "$",
            "jQuery",
            "ga_options",
            "gaePlaceholders",
            "gaeMapper",
            "newClickElement",
            "wp",
            "swv",
            "wpcf7",
            "data_arr",
            "wpcf7cp_pipes",
            "_wpemojiSettings",
            "jQuery19109838476268794736",
            "google_tag_data",
            "google_tag_manager",
            "GoogleAnalyticsObject",
            "ga",
            "gaplugins",
            "gaGlobal",
            "gaData",
            "onYouTubeIframeAPIReady",
            "twemoji",
            "wpp_params",
            "WordPressPopularPosts"
        ],
        "cookies": [
            "_gid",
            "_gat_UA-130955878-1",
            "_ga_NVG4N5KLTR",
            "_ga"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports"
        ],
        "tls": {
            "san": [
                "hairsalon-locco.net",
                "www.hairsalon-locco.net"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "www.hairsalon-locco.net",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-03T08:08:40Z",
            "valid_from": "2026-09-04T08:08:41Z"
        },
        "domain_age_days": 2856,
        "apex_age_days": 2856,
        "tls_age_days": 36,
        "tls_valid_days": 89,
        "requests": 67,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 89,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:45:00Z",
        "uuid": "faab4548-d9fd-4b69-bac8-7dfaefa0851d",
        "scanned_at": "2026-10-12T11:52:31Z",
        "final_url": "https://hairsalon-locco.net/",
        "status": 200,
        "history": [
            {
                "url": "https://hairsalon-locco.net/",
                "status": 200
            }
        ],
        "dom_hash": "5276e84c10b16611dcff15d6c21149c4015e45522aca3221c7a520fa03c9e582",
        "doc_hash": "4c90deda6f2a590356edf2fa754eb2ea9ab44a32c66645c042af87f7466691f7",
        "domain_risks": [
            "Fashion",
            "Society & Lifestyle"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "hairsalon-locco.net",
                "type": "A",
                "value": "162.43.94.73"
            }
        ],
        "dnssec_valid": false,
        "ip": "162.43.94.73",
        "whois": {
            "registrar": "XServer, Inc.",
            "created": "2018-12-12T03:23:36Z",
            "updated": "2025-10-19T18:55:58Z",
            "expires": "2026-12-12T03:23:36Z",
            "nameservers": [
                "ns1.xserver.jp",
                "ns2.xserver.jp",
                "ns3.xserver.jp",
                "ns4.xserver.jp",
                "ns5.xserver.jp"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T02:38:40Z",
        "analysis_at": "2026-10-16T02:01:19Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 5,
            "suspicious": 2,
            "undetected": 32
        },
        "detections": {
            "Sophos": "malware",
            "SOCRadar": "phishing",
            "URLQuery": "suspicious",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Malicious, Society/Lifestyle (alphaMountain.ai)"
        },
        "registrar": "XServer, Inc.",
        "created": "2018-12-12T03:23:36Z",
        "expires": "2026-12-12T03:23:36Z",
        "updated": "2025-10-19T18:55:58Z",
        "first_seen": "2023-10-05T12:48:42Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "MX",
                "value": "hairsalon-locco.net",
                "priority": 0
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns5.xserver.jp"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "root.xserver.jp",
                "value": "ns1.xserver.jp"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns2.xserver.jp"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns4.xserver.jp"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns1.xserver.jp"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 +a:sv15072.xserver.jp +a:hairsalon-locco.net +mx include:spf.sender.xserver.jp ~all"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "162.43.94.73"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns3.xserver.jp"
            }
        ],
        "dns_at": "2026-10-16T02:01:35Z",
        "jarm": "29d29d15d29d29d00042d42d0000008fe5654c9239cdb4052d3ab65a579afa",
        "cert": {
            "san": [
                "hairsalon-locco.net",
                "www.hairsalon-locco.net"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "68fa619ec9794fb05b39a676de423e9994f",
            "sha256": "42c83b66ebd65b8b1dc205ecbe9007f2ac7a487d2537f9ae5d793f2176c9306e",
            "subject": "www.hairsalon-locco.net",
            "valid_to": "2026-12-03T08:08:40Z",
            "valid_from": "2026-09-04T08:08:41Z"
        },
        "whois": {
            "registrar": "XServer, Inc.",
            "registrar_iana_id": "1557",
            "registrar_url": "https://www.xserver.co.jp/",
            "created": "2018-12-12T03:23:36Z",
            "updated": "2025-10-19T18:55:58Z",
            "expires": "2026-12-12T03:23:36Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.xserver.jp",
                "ns2.xserver.jp",
                "ns3.xserver.jp",
                "ns4.xserver.jp",
                "ns5.xserver.jp"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2026-12-12T03:23:36Z",
                "last changed": "2025-10-19T18:55:58Z",
                "registration": "2018-12-12T03:23:36Z",
                "last update of RDAP database": "2025-10-19T18:55:58Z"
            }
        }
    }
}
```