# khao.online — KHAO loading screen with circular logo | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/khao.online/ Machine-readable companion: https://phishdestroy.io/domain/khao.online/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: Last known active - First observed by PhishDestroy: 2026-10-30 20:47:15 UTC - Selected availability observation: 2026-11-09T23:32:53Z - Stored record updated: 2026-11-09 23:32:53 UTC - VirusTotal detections in the stored snapshot: 15/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: Netregistry Wholesale Pty Ltd - Registrar country in stored WHOIS data: GB - Last stored HTTP status: 200 (observed: 2026-11-09T23:32:53Z) - Registration date in stored WHOIS data: 2026-09-14 13:30:40 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a18e8f-39b6-77a9-9afa-33e13103b5a4/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/khao.online - Certificate Transparency search: https://crt.sh/?q=%25.khao.online - Web Archive lookup: https://web.archive.org/web/*/https://khao.online/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy records khao.online as a KHAO-branded loading screen showing a circular logo on a dark background. The captured khao.online page presents the KHAO brand as a circular yellow logo centered on a dark background, with the Bengali tagline "যত খাবে তত চাবে" set beneath the wordmark. The screen shows no menu, form or other interactive element, so the only visible action is waiting for the page to finish loading its content. The page title and metadata describe KHAO as a snack and gathering spot in Mohammadpur offering items such as singara, crispy chicken rolls, khichuri and chatpati, none of which appear in this capture. The stored VirusTotal domain result reports 15 detections out of 92 engines. CRDF reported "malicious"; DNS8 reported "suspicious". Package revision: 3f65b99b68138d37f3704fb6eb0754816fcc716d7cb7a1692f84c90c422d2b96 Text generated (not scan time): 2026-10-30 22:22:07 Reviewed evidence snapshot: {"domain":"khao.online","screenshot_available":true,"page_title":"KHAO — যত খাবে তত চাবে","original_meta_description":"KHAO — যত খাবে তত চাবে। মোহাম্মদপুরের স্ন্যাক আর আড্ডার জায়গা: নাগা আলু সিঙ্গারা, ক্রিসপি চিকেন রোল, খিচুড়ি, চটপটি।","metadata_observed_on":"2026-10-30","virustotal":{"detections":15,"engines":92,"malicious":11,"suspicious":4,"retrieved_date":"2026-10-30","analysis_date":"2026-10-26","flagging_vendors":["CRDF","DNS8","ESET","VIPRE","G-Data","Lionic","Sophos","Fortinet","SOCRadar","Kaspersky","Seclookup","Gridinsoft","BitDefender","alphaMountain.ai","Forcepoint ThreatSeeker"],"vendor_labels":{"CRDF":"malicious","DNS8":"suspicious","ESET":"suspicious","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","Fortinet":"spam","SOCRadar":"phishing","Kaspersky":"phishing","Seclookup":"malicious","Gridinsoft":"suspicious","BitDefender":"phishing","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"scope":"domain"},"capture_context":{"relationship":"screenshot associated with this domain record","captured_at":"2026-10-30T21:19:19Z","final_host":"khao.online","captured_on":"2026-10-30"},"virustotal_public_summary":"The stored VirusTotal domain result reports 15 detections out of 92 engines. CRDF reported \"malicious\"; DNS8 reported \"suspicious\".","page_paragraph_target_characters":517} Source facts (timestamps as stored): {"record_id":1715298,"first_recorded_at":"2026-10-30 21:47:15","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":15,"denominator":92,"malicious":11,"suspicious":4,"vendors":{"CRDF":"malicious","DNS8":"suspicious","ESET":"suspicious","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","Fortinet":"spam","SOCRadar":"phishing","Kaspersky":"phishing","Seclookup":"malicious","Gridinsoft":"suspicious","BitDefender":"phishing","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"observed_at":"2026-10-26T17:01:51Z","checked_at":null,"fetched_at":"2026-10-30T21:19:14Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":15,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","BitDefender","CRDF","DNS8","ESET","Forcepoint ThreatSeeker","Fortinet","G-Data","Gridinsoft","Kaspersky","Lionic","Seclookup","SOCRadar","Sophos","VIPRE"],"observed_at":"2026-10-26 17:01:51","checked_at":"2026-10-30 22:19:15","fetched_at":"2026-10-30 21:19:15","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"CRDF":"malicious","DNS8":"suspicious","ESET":"suspicious","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","Fortinet":"spam","SOCRadar":"phishing","Kaspersky":"phishing","Seclookup":"malicious","Gridinsoft":"suspicious","BitDefender":"phishing","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"vendor_names":["CRDF","DNS8","ESET","VIPRE","G-Data","Lionic","Sophos","Fortinet","SOCRadar","Kaspersky","Seclookup","Gridinsoft","BitDefender","alphaMountain.ai","Forcepoint ThreatSeeker"],"stats":{"timeout":0,"harmless":45,"malicious":11,"suspicious":4,"undetected":32}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-10 00:00:28"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-10-31 00:30:20"},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"current_http_probe","record_id":1715298,"scope":"checked_url","observed_at":"2026-11-09T23:32:53Z","http_status":200,"http_observed_at":"2026-11-09T23:32:53Z","stored_http_code":200,"stored_http_observed_at":"2026-11-09T23:32:53Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"served_at_root","content_classification_at":"2026-11-09T11:29:27Z","registration_state":"unknown","policy":"20261102-dated-availability-v2"}} ## Stored page captures - URLScan · 2026-10-30: https://screenshots.phishdestroy.io/01a18e8f-39b6-77a9-9afa-33e13103b5a4.png Captured: 2026-10-30 20:45:50 UTC Source report: https://urlscan.io/result/01a18e8f-39b6-77a9-9afa-33e13103b5a4/ - URLScan · 2026-10-13: https://screenshots.phishdestroy.io/us/01a1363c-7e6c-700c-b2ac-34b6d1faef98.png Captured: 2026-10-13 17:08:27 UTC Source report: https://urlscan.io/result/01a1363c-7e6c-700c-b2ac-34b6d1faef98/ SHA-256: 412559346c4003f09a22cc4786a7e757352b95c820a80c024e0c4388b57fe973 - URLScan · 2026-10-06: https://screenshots.phishdestroy.io/us/01a11184-6903-7090-b448-c63352328377.png Captured: 2026-10-06 14:00:59 UTC Source report: https://urlscan.io/result/01a11184-6903-7090-b448-c63352328377/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a11638-4d4b-777d-9afc-d6778bbd2254.png Captured: 2026-10-07 11:55:57 UTC Source report: https://urlscan.io/result/01a11638-4d4b-777d-9afc-d6778bbd2254/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/fd801d0f-c84d-4c97-a61f-56cd0ead25b7.png Captured: 2026-10-30 21:19:19 UTC Source report: https://radar.cloudflare.com/scan/fd801d0f-c84d-4c97-a61f-56cd0ead25b7 SHA-256: 25ab33f1eccb1b3c19ac6b1c72ff94776f144490685dc0c0c9483b8fadca56f9 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-30T20:47:32Z", "uuid": "01a18e8f-39b6-77a9-9afa-33e13103b5a4", "scanned_at": "2026-10-30T20:45:50Z", "final_url": "https://khao.online/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://khao.online/", "from": "http://khao.online/", "status": 307 } ], "ip": "104.21.24.184", "domains": [ "fonts.gstatic.com", "www.gstatic.com", "static.cloudflareinsights.com" ], "ips": [ "142.250.195.131", "104.16.80.73", "104.21.24.184" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "doc_hash": "dc175430d01e6ac491289e5f93b7b6db9511d6df8379879ab4f11a4e8149e5d9", "script_hashes": [ "0a32a3a835658532f03995221d81f105e72b507437d5be614a56fef8433c23c7", "55f653a994b1d77af59b4c79840b94be9c638ff67e3d1c4fa99ff8122bb5c721" ], "globals": [ "__cfBeacon", "_flutter", "flutterCanvasKitLoaded", "flutterCanvasKit" ], "tls": { "san": [ "khao.online" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "khao.online", "protocol": "TLS 1.3", "valid_to": "2027-01-11T14:04:23Z", "valid_from": "2026-10-13T13:04:24Z" }, "domain_age_days": 2524, "apex_age_days": 2524, "tls_age_days": 17, "tls_valid_days": 90, "requests": 35, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 55, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-30T21:21:38Z", "uuid": "fd801d0f-c84d-4c97-a61f-56cd0ead25b7", "scanned_at": "2026-10-30T21:19:19Z", "final_url": "https://khao.online/", "status": 200, "history": [ { "url": "https://khao.online/", "status": 200 } ], "dom_hash": "e7f5afe0747670c90d305d810b1e5bb3ebee22288a4e969a1edc7d7a6fa2b34f", "doc_hash": "dc175430d01e6ac491289e5f93b7b6db9511d6df8379879ab4f11a4e8149e5d9", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "khao.online", "type": "A", "value": "188.114.96.0" }, { "name": "khao.online", "type": "A", "value": "188.114.97.0" }, { "name": "khao.online", "type": "AAAA", "value": "2a06:98c1:3120::" }, { "name": "khao.online", "type": "AAAA", "value": "2a06:98c1:3121::" } ], "dnssec_valid": false, "ip": "127.0.1.31", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Netregistry Wholesale Pty Ltd", "created": "2026-09-14T15:30:39Z", "updated": "2026-10-13T13:49:05Z", "expires": "2027-09-14T15:30:39Z", "nameservers": [ "dayana.ns.cloudflare.com", "kurt.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-30T21:19:14Z", "analysis_at": "2026-10-26T17:01:51Z", "stats": { "timeout": 0, "harmless": 45, "malicious": 11, "suspicious": 4, "undetected": 32 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Fortinet": "spam", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "Netregistry Wholesale Pty Ltd", "created": "2026-09-14T15:30:39Z", "expires": "2027-09-14T15:30:39Z", "updated": "2026-09-19T15:31:04Z", "first_seen": "2024-01-21T15:23:58Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "kurt.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.24.184" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "dayana.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:dbe5" }, { "ttl": 21600, "type": "NS", "value": "dayana.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.219.229" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::6815:18b8" } ], "dns_at": "2026-10-26T17:07:16Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "khao.online" ], "issuer": "Google Trust Services / WE1", "serial": "b6041526519d8f0b0ecbf5fa7e93135c", "sha256": "4f1a382bd1ac2a1a01773ef05c40c1a68f5cfa5c48228408d1419eba1ce8f91d", "subject": "khao.online", "valid_to": "2027-01-11T14:04:23Z", "valid_from": "2026-10-13T13:04:24Z" }, "whois": { "registrar": "Netregistry Wholesale Pty Ltd", "registrar_iana_id": "13", "registrar_url": "https://hosting.com/", "created": "2026-09-14T15:30:39Z", "updated": "2026-09-19T15:31:04Z", "expires": "2027-09-14T15:30:39Z", "status": [ "ok" ], "nameservers": [ "ns1.mysecurecloudhost.com", "ns2.mysecurecloudhost.com", "ns3.mysecurecloudhost.com", "ns4.mysecurecloudhost.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "active" ], "events": { "expiration": "2027-09-14T15:30:39Z", "last changed": "2026-10-13T13:49:05Z", "registration": "2026-09-14T15:30:39Z", "last update of RDAP database": "2026-10-26T17:07:15Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-30T21:03:43Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "khao.online" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-30T20:42:07Z", "first": "2020-08-08T00:01:18Z", "changes": 5, "days_archived": 7, "scans_per_day": 0, "avg_page_bytes": 3649 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://khao.online/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 1 }, "social_tags": { "ogUrl": "https://khao.online/", "title": "KHAO — যত খাবে তত চাবে", "ogType": "website", "ogImage": "https://khao.online/icons/Icon-512.png", "ogTitle": "KHAO — যত খাবে তত চাবে", "ogSiteName": "KHAO", "themeColor": "#111111", "description": "KHAO — যত খাবে তত চাবে। মোহাম্মদপুরের স্ন্যাক আর আড্ডার জায়গা: নাগা আলু সিঙ্গারা, ক্রিসপি চিকেন রোল, খিচুড়ি, চটপটি।", "twitterCard": "summary", "canonicalUrl": "https://khao.online/", "ogDescription": "মোহাম্মদপুরের স্ন্যাক আর আড্ডার জায়গা: নাগা আলু সিঙ্গারা, ক্রিসপি চিকেন রোল, খিচুড়ি, চটপটি।" }, "trackers": { "requests": 3 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 1, "tls": 66, "wait": 109, "connect": 8, "download": 0 }, "response_ms": 184 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 4416, "co2_grams": 0.0002, "cleaner_than": 89 }, "dns_server": { "ns": [ { "ip": "173.245.59.193", "host": "kurt.ns.cloudflare.com" }, { "ip": "162.159.38.103", "host": "dayana.ns.cloudflare.com" } ], "zone": "khao.online" }, "location": { "ip": "2a06:98c1:3121::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "khao.online" }, "dns": { "A": [ "188.114.96.3", "188.114.97.3" ], "NS": [ "kurt.ns.cloudflare.com", "dayana.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"dayana.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417420514, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3120::3", "2a06:98c1:3121::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3120::3", "family": 6 }, "redirects": { "chain": [ "https://khao.online" ] }, "whois": { "registrar": "Netregistry Wholesale Pty Ltd", "created": "2026-09-14T15:30:39Z", "updated": "2026-10-13T13:49:05Z", "expires": "2027-09-14T15:30:39Z", "status": [ "ok https://icann.org/epp" ], "nameservers": [ "dayana.ns.cloudflare.com", "kurt.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } } } } ``` Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/cf/fd801d0f-c84d-4c97-a61f-56cd0ead25b7.png","source":"Cloudflare Radar","report_url":"https://radar.cloudflare.com/scan/fd801d0f-c84d-4c97-a61f-56cd0ead25b7","captured_at":"2026-10-30T21:19:19Z","sha256":"25ab33f1eccb1b3c19ac6b1c72ff94776f144490685dc0c0c9483b8fadca56f9","model_image_sha256":"032eef7dd55bd646cb6f60b7341e2bc23e331e43ace03ff53759173e451ff4c9","available":true,"content_status":null} ## Complete dated records Availability observations: https://phishdestroy.io/domain/khao.online/records.json?source=availability&format=json Source observation history: https://phishdestroy.io/domain/khao.online/records.json?source=detections&format=json PhishStats records: https://phishdestroy.io/domain/khao.online/records.json?source=phishstats&format=json Sent report records: https://phishdestroy.io/domain/khao.online/records.json?source=sent_reports&format=json Report history: https://phishdestroy.io/domain/khao.online/records.json?source=report_history&format=json Repeat report records: https://phishdestroy.io/domain/khao.online/records.json?source=rereports&format=json Follow-up records: https://phishdestroy.io/domain/khao.online/records.json?source=followups&format=json Content observations: https://phishdestroy.io/domain/khao.online/records.json?source=content&format=json ## Dated availability observation Latest stored reachability observation ```json { "state": "alive", "label_key": "availability.active", "detail_key": "detail.latest_reachability", "params": [], "source": "current_http_probe", "record_id": 1715298, "scope": "checked_url", "observed_at": "2026-11-09T23:32:53Z", "http_status": 200, "http_observed_at": "2026-11-09T23:32:53Z", "stored_http_code": 200, "stored_http_observed_at": "2026-11-09T23:32:53Z", "legacy_site_status": "alive", "supports_outcome_badge": false, "content_classification": "served_at_root", "content_classification_at": "2026-11-09T11:29:27Z", "registration_state": "unknown", "policy": "20261102-dated-availability-v2" } ```