# PhishDestroy domain threat record: kaliurang.bilagher.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/kaliurang.bilagher.com/ Machine-readable companion: https://phishdestroy.io/domain/kaliurang.bilagher.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-10-19 01:22:03 UTC - Last availability or vendor check: 2026-10-21 01:21:26 UTC - Stored record updated: 2026-10-22 14:22:48 UTC - VirusTotal detections in the stored snapshot: 3/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: marinade ## Stored infrastructure - Observed IP address: 129.121.143.39 - Registrar in stored WHOIS data: TurnCommerce, Inc. DBA NameBright.com - Registrar country in stored WHOIS data: ID - Registration date (registry RDAP, bilagher.com): 2018-01-02 19:12:32 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a151c0-adc0-76d4-b03a-fbf410c0a6e8/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/kaliurang.bilagher.com - Certificate Transparency search: https://crt.sh/?q=%25.kaliurang.bilagher.com - Web Archive lookup: https://web.archive.org/web/*/https://kaliurang.bilagher.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview kaliurang.bilagher.com presents itself as The Pinewood Kitchen, a site for honest recipes, but was first detected by PhishDestroy on 2026-10-19. The domain was registered on 2018-01-02 and is hosted on Oracle Corporation infrastructure in the US. As of 2026-10-19, the site is alive but its content is unreachable. How the scam works The page title suggests a benign recipe site, but the domain’s detections and blocklist status raise concerns about potential misuse. Visitors risk exposure to phishing, malicious scripts, or deceptive content designed to trick users or harvest data. Anyone who interacts with the site may face credential theft, malware downloads, or redirection to harmful pages. Evidence On 2026-10-19, VirusTotal flagged the domain with 3 detections out of 92 engines by vendors including alphaMountain.ai, CRDF, and Gridinsoft. The domain is also listed on the PhishDestroy, MetaMask, and SEAL blocklists and marked as DBL_ABUSED_PHISH by Spamhaus. Infrastructure The domain was registered on 2018-01-02 via TurnCommerce, Inc. DBA NameBright.com. It is hosted on Oracle Corporation’s network (AS31898) at IP 129.121.143.39 in the US, with a TLS certificate issued by YR1. What to do If you visited the site, avoid entering any credentials or downloading files. Scan your device for malware and monitor accounts for unusual activity. Wallet users should revoke any suspicious approvals if they connected a wallet. Defenders should block the domain and IP, and report it to PhishDestroy and other threat-intelligence platforms. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a151c0-adc0-76d4-b03a-fbf410c0a6e8/ VirusTotal report: https://www.virustotal.com/gui/domain/kaliurang.bilagher.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=kaliurang.bilagher.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 03:31:09 UTC ## Stored page captures - Primary capture: https://i.ibb.co/mr9CY3Nd/589ab5f4de90.png Captured: 2026-10-19 01:23:14 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a151c0-adc0-76d4-b03a-fbf410c0a6e8.png Captured: 2026-10-19 01:23:14 UTC Source report: https://urlscan.io/result/01a151c0-adc0-76d4-b03a-fbf410c0a6e8/ - URLScan capture 2: https://urlscan.io/screenshots/01a14e78-e3f9-755b-b4a0-8ef584e37dec.png Captured: 2026-10-19 01:22:03 UTC Source report: https://urlscan.io/result/01a151c0-adc0-76d4-b03a-fbf410c0a6e8/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/45eac069-14df-4a18-aec8-70abd0b3b7c6.png Captured: 2026-10-19 01:22:30 UTC Source report: https://radar.cloudflare.com/scan/45eac069-14df-4a18-aec8-70abd0b3b7c6 SHA-256: 54b60637eb2fb93b64a2874841789dee5686be15c778d0f05c1fd792cd04888e - URLQuery: https://screenshots.phishdestroy.io/uq/75ce54c4-65b7-49b9-9cc4-fcb71a63bfa9.png Source report: https://urlquery.net/report/75ce54c4-65b7-49b9-9cc4-fcb71a63bfa9 SHA-256: 5a3278f5b2cc51721fe4b055e3f119ec38bc416a1b45140c9bdd1f10464e5534 - URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14e78-e3f9-755b-b4a0-8ef584e37dec.png Captured: 2026-10-18 10:05:16 UTC Source report: https://urlscan.io/result/01a14e78-e3f9-755b-b4a0-8ef584e37dec/ SHA-256: f92e7c795a52c5cc04e0f0f5d727a572fbc0f44bb0fb4eb22f44e662ed028dbf - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a151c4-92ea-74df-b71f-df80dc2ea23a.png Captured: 2026-10-19 01:26:46 UTC Source report: https://urlscan.io/result/01a151c4-92ea-74df-b71f-df80dc2ea23a/ SHA-256: f92e7c795a52c5cc04e0f0f5d727a572fbc0f44bb0fb4eb22f44e662ed028dbf ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T16:45:01Z", "uuid": "01a151c0-adc0-76d4-b03a-fbf410c0a6e8", "scanned_at": "2026-10-19T01:22:33Z", "final_url": "https://kaliurang.bilagher.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://kaliurang.bilagher.com/", "from": "http://kaliurang.bilagher.com/", "status": 307 } ], "ip": "129.121.143.39", "ptr": "129-121-143-39.unifiedlayer.com", "ips": [ "129.121.143.39" ], "asns": [ "31898" ], "countries": [ "US" ], "doc_hash": "325aae89777afbf39226bb501026d49b261f047b5b8e51cf5eaa7be981f6a7a1", "tls": { "san": [ "kaliurang.bilagher.com" ], "cipher": "AES_128_GCM", "issuer": "YR1", "subject": "kaliurang.bilagher.com", "protocol": "TLS 1.3", "valid_to": "2027-01-15T19:36:50Z", "valid_from": "2026-10-17T19:36:51Z" }, "domain_age_days": 0, "apex_age_days": 1342, "tls_age_days": 1, "tls_valid_days": 89, "requests": 2, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 22, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T17:56:06Z", "uuid": "45eac069-14df-4a18-aec8-70abd0b3b7c6", "scanned_at": "2026-10-19T01:22:30Z", "final_url": "https://kaliurang.bilagher.com/", "status": 200, "history": [ { "url": "https://kaliurang.bilagher.com/", "status": 200 } ], "dom_hash": "1cc6b8dcdf92ca546d9cc0c5886f6e386a44499f60dba4e06d0d05f8751572fd", "doc_hash": "325aae89777afbf39226bb501026d49b261f047b5b8e51cf5eaa7be981f6a7a1", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "kaliurang.bilagher.com", "type": "A", "value": "129.121.143.39" } ], "dnssec_valid": false, "ip": "129.121.143.39", "whois": { "registrar": "TurnCommerce, Inc. DBA NameBright.com", "created": "2018-01-02T19:12:32Z", "updated": "2026-10-17T19:17:44Z", "expires": "2027-01-02T19:12:32Z", "nameservers": [ "jake.ns.cloudflare.com", "natasha.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-20T18:07:23Z", "analysis_at": "2026-10-18T03:35:50Z", "stats": { "timeout": 0, "harmless": 51, "malicious": 3, "suspicious": 2, "undetected": 36 }, "detections": { "CRDF": "malicious", "SOCRadar": "suspicious", "Gridinsoft": "suspicious", "ChainPatrol": "malicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Business/Economy, Malicious (alphaMountain.ai)" }, "created": "2018-01-02T00:00:00Z", "updated": "2026-02-13T00:00:00Z", "first_seen": "2026-10-17T20:43:21Z", "dns": [ { "ttl": 300, "type": "A", "value": "129.121.143.39" } ], "dns_at": "2026-10-18T03:53:36Z", "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b", "cert": { "san": [ "kaliurang.bilagher.com" ], "issuer": "Let's Encrypt / YR1", "serial": "66ff14a96f9d4d91cdeb9e5d8bf4f518b4f", "sha256": "1d596a8d8a7db0a5b011a4e8a6e4f9b74925af37d5a6c740bc09a04941d12d3a", "subject": "kaliurang.bilagher.com", "valid_to": "2027-01-15T19:36:50Z", "valid_from": "2026-10-17T19:36:51Z" }, "whois": [] } } ```