# PhishDestroy domain threat record: k-h.co.il

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/k-h.co.il/
Machine-readable companion: https://phishdestroy.io/domain/k-h.co.il/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 23:23:28 UTC
- Last availability or vendor check: 2026-10-22 10:29:05 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 4/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: linkedin

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Communigal Communication Ltd
- Last stored HTTP status: 308

## Evidence links

- URLScan report: https://urlscan.io/result/01a1281f-4a5b-71df-94c2-fef9ca8fce41/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/k-h.co.il
- Certificate Transparency search: https://crt.sh/?q=%25.k-h.co.il
- Web Archive lookup: https://web.archive.org/web/*/https://k-h.co.il/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
k-h.co.il presents itself as the website of Keynan, Haim, Hillel & Co., showing the firm's name in both Hebrew and English in its page title. PhishDestroy classifies it as an impersonation phishing page aimed at people who believe they are dealing with this law firm. We first flagged it on 2026-10-11. As of 2026-10-19 the site is still online and its content now redirects visitors elsewhere.

How the scam works
Lookalike law-firm sites trade on the authority of a real legal practice. A victim who trusts the page may be asked to submit identity documents, case details or login credentials, or to pay retainers, court fees or settlement amounts into accounts the operators control. In crypto fraud, fake legal fronts also pose as asset-recovery specialists who promise to retrieve stolen funds for an upfront fee. Victims lose money, sensitive personal data, or both. The active redirect means the domain can quietly send traffic to a different page at any moment.

Evidence
On 2026-10-16, four of 92 VirusTotal engines flagged the domain: Dr.Web, Fortinet, Gridinsoft and URLQuery. That is a low detection count, so most security tools will not warn a visitor yet. Four unrelated vendors reaching the same verdict still independently supports our classification. The domain also appears in 33 AlienVault OTX threat pulses, which shows other researchers are tracking it. PhishDestroy is currently the only blocklist listing it.

Infrastructure
The .co.il domain is registered through Communigal Communication Ltd. It sits behind Cloudflare (AS13335), with an edge address in the US, so the real origin server is hidden. The site uses a free Let's Encrypt certificate, which means the browser padlock only confirms an encrypted connection. It says nothing about who runs the site.

What to do
Do not pay any fee, retainer or recovery charge requested through this site. Reach Keynan, Haim, Hillel & Co. only through contact details you find independently, such as a bar association directory. If you sent money, contact your bank or payment provider immediately and report the transfer as fraud. If you uploaded ID documents, watch for identity misuse. If you entered a password, change it everywhere you reused it and turn on two-factor authentication. Defenders should block k-h.co.il and wherever it redirects, and search mail and proxy logs for earlier visits.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1281f-4a5b-71df-94c2-fef9ca8fce41/
VirusTotal report: https://www.virustotal.com/gui/domain/k-h.co.il
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=k-h.co.il
Archived copy: https://web.archive.org/web/20261010230146/https://www.k-h.co.il/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:27:13 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/ZpRHg9NP/ad9ab5a98b93.png
  Captured: 2026-10-10 23:23:28 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a1281f-4a5b-71df-94c2-fef9ca8fce41.png
  Captured: 2026-10-10 23:23:28 UTC
  Source report: https://urlscan.io/result/01a1281f-4a5b-71df-94c2-fef9ca8fce41/
- URLScan capture 2: https://urlscan.io/screenshots/01a07c84-653c-73ab-bbac-4f7b1b123800.png
  Captured: 2026-10-10 23:00:18 UTC
  Source report: https://urlscan.io/result/01a1281f-4a5b-71df-94c2-fef9ca8fce41/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/95f2c18d-5595-4770-b698-4152963f21aa.png
  Captured: 2026-10-12 11:26:18 UTC
  Source report: https://radar.cloudflare.com/scan/95f2c18d-5595-4770-b698-4152963f21aa
  SHA-256: 7d30f83940159c3ddb5f58192bcac33d43d5f96c74b7652da8277e99f538d1bd
- URLQuery: https://screenshots.phishdestroy.io/uq/47c811c8-4c91-47c7-8049-00059d40e115.png
  Source report: https://urlquery.net/report/47c811c8-4c91-47c7-8049-00059d40e115
  SHA-256: bf98b18d16390d9c5f81400aa18f66daa4f19ecae9382a6ca8540d514c793d20
- URLScan · 2026-08-04: https://screenshots.phishdestroy.io/us/019fcafe-8b95-7488-8928-7cf788830592.png
  Captured: 2026-08-04 04:18:35 UTC
  Source report: https://urlscan.io/result/019fcafe-8b95-7488-8928-7cf788830592/
  SHA-256: 2ef701ae8765e5dc1bf3345b2f8cb1bb1822b4344545226a804101e5737b59ff
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06c7a-0867-71ed-a782-8c36559b81d9.png
  Captured: 2026-09-04 12:52:31 UTC
  Source report: https://urlscan.io/result/01a06c7a-0867-71ed-a782-8c36559b81d9/
  SHA-256: 2ef701ae8765e5dc1bf3345b2f8cb1bb1822b4344545226a804101e5737b59ff
- URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07c84-653c-73ab-bbac-4f7b1b123800.png
  Captured: 2026-09-07 15:37:39 UTC
  Source report: https://urlscan.io/result/01a07c84-653c-73ab-bbac-4f7b1b123800/
  SHA-256: 2ef701ae8765e5dc1bf3345b2f8cb1bb1822b4344545226a804101e5737b59ff

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:33:04Z",
        "uuid": "01a1281f-4a5b-71df-94c2-fef9ca8fce41",
        "scanned_at": "2026-10-10T23:21:50Z",
        "final_url": "https://www.k-h.co.il/",
        "status": 200,
        "redirected": "parent-domain",
        "redirects": [
            {
                "to": "https://k-h.co.il/",
                "from": "http://k-h.co.il/",
                "status": 307
            },
            {
                "to": "https://www.k-h.co.il/",
                "from": "https://k-h.co.il/",
                "status": 308
            }
        ],
        "ip": "188.114.97.3",
        "domains": [
            "region1.google-analytics.com",
            "www.googletagmanager.com",
            "www.google-analytics.com",
            "fonts.gstatic.com",
            "fonts.googleapis.com",
            "k-h.co.il"
        ],
        "ips": [
            "216.239.32.36",
            "216.239.32.178",
            "192.178.183.94",
            "142.251.110.97",
            "142.251.14.95",
            "188.114.97.3"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "www.linkedin.com",
            "www.fullpower.co.il"
        ],
        "doc_hash": "7c0da8a637f93ea96d32bb530bd31fd8d4b27073bce777efb36d9eb459115646",
        "script_hashes": [
            "fc774906082b59dedcfc55b8ef127783b6d056578ff4586a8ebbdb81bbe286f1",
            "5083905862c2b7aa8a84c4f2313d359d2288fb25fbe1ff577fa7325eff2ed2d9",
            "f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a",
            "f4f37c5d1fb20aa827424c86c418ec04b4c6c7e9b71966d8252529101648c4bf"
        ],
        "globals": [
            "ecs_ajax_params",
            "dataLayer",
            "PojoA11yOptions",
            "_createClass",
            "_classCallCheck",
            "RocketBrowserCompatibilityChecker",
            "RocketPreloadLinksConfig",
            "elementorFrontendConfig",
            "wp",
            "ElementorProFrontendConfig",
            "lazyLoadOptions",
            "canBeLoaded",
            "ECS_load_next_page",
            "EleCustomSkinChangeUrlPage",
            "EleCustomSkinReInitJs",
            "ECS_hooks",
            "ECS_Columns_Count",
            "ECS_add_action",
            "ECS_do_action",
            "elementorNav",
            "navScrolledClass",
            "yOffset",
            "EleCustomSkinSlider",
            "EleCustomSkinSliderArchive",
            "ECS_reset_masonry",
            "EleCustomSkinMasonry",
            "EleCustomSkinMasonryArchive",
            "EleCustomSkinItemLink",
            "ECScheckInView",
            "lazyLoadThumb",
            "lazyLoadYoutubeIframe",
            "jQuery",
            "webpackChunkelementor",
            "elementorModules",
            "Waypoint",
            "Swiper",
            "ShareLink",
            "DialogsManager",
            "elementorFrontend",
            "webpackChunkelementor_pro"
        ],
        "cookies": [
            "lenix_first_visit",
            "_ga_S7VZ9RP8KS",
            "_ga",
            "_gid",
            "_gat_UA-222495890-1",
            "_ga_YR34SGTZXD"
        ],
        "storage_keys": [
            "elementor"
        ],
        "tls": {
            "san": [
                "*.k-h.co.il",
                "k-h.co.il"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "k-h.co.il",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-28T08:08:22Z",
            "valid_from": "2026-08-30T08:08:23Z"
        },
        "domain_age_days": 2533,
        "apex_age_days": 2550,
        "tls_age_days": 41,
        "tls_valid_days": 89,
        "requests": 47,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -99,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/8.1.34"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:44:30Z",
        "uuid": "95f2c18d-5595-4770-b698-4152963f21aa",
        "scanned_at": "2026-10-12T11:26:18Z",
        "final_url": "https://www.k-h.co.il/",
        "status": 200,
        "redirected": "subdomain",
        "history": [
            {
                "url": "https://k-h.co.il/",
                "status": 308
            },
            {
                "url": "https://www.k-h.co.il/",
                "status": 200
            }
        ],
        "dom_hash": "2d4b33aadd55896748a40b5ac5fc0e919273b1a615031c07cfb3cb7025023e43",
        "doc_hash": "163090501d555b3f77316c6493571f82d1b0fe6e3df5ed8b365b1516a15e5539",
        "domain_risks": [
            "Government/Legal",
            "Government & Politics"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "k-h.co.il",
                "type": "A",
                "value": "104.21.65.85"
            },
            {
                "name": "k-h.co.il",
                "type": "A",
                "value": "172.67.160.162"
            },
            {
                "name": "k-h.co.il",
                "type": "AAAA",
                "value": "2606:4700:3036::6815:4155"
            },
            {
                "name": "k-h.co.il",
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:a0a2"
            },
            {
                "name": "www.k-h.co.il",
                "type": "A",
                "value": "172.67.160.162"
            },
            {
                "name": "www.k-h.co.il",
                "type": "A",
                "value": "104.21.65.85"
            },
            {
                "name": "www.k-h.co.il",
                "type": "AAAA",
                "value": "2606:4700:3036::6815:4155"
            },
            {
                "name": "www.k-h.co.il",
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:a0a2"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.160.162",
        "whois": {
            "registrar": "Communigal Communication Ltd",
            "nameservers": [
                "alaric.ns.cloudflare.com",
                "danica.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T02:38:05Z",
        "analysis_at": "2026-10-20T02:00:15Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 3,
            "suspicious": 1,
            "undetected": 32
        },
        "detections": {
            "Dr.Web": "malicious",
            "Fortinet": "malware",
            "URLQuery": "suspicious",
            "Gridinsoft": "malicious"
        },
        "reputation": 0,
        "categories": {
            "Dr.Web": "known infection source",
            "BitDefender": "porn",
            "alphaMountain.ai": "Government/Legal (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "business and economy"
        },
        "popularity": {
            "Alexa": 598325,
            "Statvoo": 598325
        },
        "first_seen": "2023-10-06T08:50:44Z",
        "dns": [
            {
                "ttl": 300,
                "type": "MX",
                "value": "kh-co-il0c.mail.protection.outlook.com",
                "priority": 0
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:a0a2"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::6815:4155"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "danica.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "v=spf1 include:spf.protection.outlook.com -all"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.65.85"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.160.162"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "alaric.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "alaric.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "d68164d7010fb692fac3e778608eaaa9c07359a2a6e60e5e"
            }
        ],
        "dns_at": "2026-10-20T02:00:29Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.k-h.co.il",
                "k-h.co.il"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5d4352d35ed9223860d0181e7afd41f25c8",
            "sha256": "3c38a9eea9ff1837380bbc58f651ad222baa57b893155a3201d1bb868099f582",
            "subject": "k-h.co.il",
            "valid_to": "2026-11-28T08:08:22Z",
            "valid_from": "2026-08-30T08:08:23Z"
        },
        "whois": {
            "dnssec": "unsigned"
        }
    }
}
```