# PhishDestroy domain threat record: lluismansilla.cat

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/lluismansilla.cat/
Machine-readable companion: https://phishdestroy.io/domain/lluismansilla.cat/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 22:59:28 UTC
- Last availability or vendor check: 2026-10-22 10:29:40 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: orca

## Stored infrastructure

- Observed IP address: 88.222.222.151
- Registrar in stored WHOIS data: NOMINALIA INTERNET S.L.
- Registrar country in stored WHOIS data: ES
- Last stored HTTP status: 200
- Registration date (registry RDAP, lluismansilla.cat): 2019-03-11 16:04:40 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a12809-3aa8-71a7-9142-8cde741e87d9/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/lluismansilla.cat
- Certificate Transparency search: https://crt.sh/?q=%25.lluismansilla.cat
- Web Archive lookup: https://web.archive.org/web/*/https://lluismansilla.cat/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
lluismansilla.cat is listed by PhishDestroy as an impersonation phishing page. Its page title presents it as the portfolio of Lluís Mansilla, a Barcelona photographer offering architecture, landscape, food and product photography. PhishDestroy first flagged the domain on 2026-10-11, and as of 2026-10-19 the site was online and still serving content. The title shows a local photography business, while our classification is impersonation phishing.

How the scam works
Impersonation pages borrow the name and look of a real person or business so visitors trust them. Here the borrowed identity is a Barcelona photography service, which suits pretexts such as booking requests, quotes, deposits or invoice payments. In schemes like this, victims typically hand over contact details, login credentials or payment information, or send money for services that never arrive. Anyone who reached the site through a link in an email or message should treat that contact as suspect.

Evidence
VirusTotal shows 6 of 92 engines flagging the domain as of 2026-10-16: alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft, Seclookup, SOCRadar and URLQuery. That is a minority verdict, but it comes from six independent vendors, including both URL reputation services and threat-intelligence feeds. The domain also appears in 34 AlienVault OTX pulses, which shows that other researchers have tracked it repeatedly. Among blocklists, PhishDestroy is the one listing it.

Infrastructure
The domain was registered on 2019-03-11 through NOMINALIA INTERNET S.L., more than seven years before PhishDestroy flagged it. This is an established .cat name, not a freshly bought throwaway domain. It resolves to 88.222.222.151 on Hostinger International Limited's network (AS47583) in Lithuania. It uses a free Let's Encrypt certificate, so the padlock in the browser says nothing about who runs the site.

What to do
If you submitted a booking form, quote request or payment on this site, contact your bank or card issuer and dispute any charge. Ignore follow-up invoices or payment requests tied to it. If you entered a password, change it here and on every other account that reuses it, and turn on two-factor authentication. To reach the photographer genuinely, use contact details you already trust rather than anything shown on the page. Defenders should block the domain and its IP at the proxy and mail gateway and search logs for visits since 2026-10-11.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a12809-3aa8-71a7-9142-8cde741e87d9/
VirusTotal report: https://www.virustotal.com/gui/domain/lluismansilla.cat
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=lluismansilla.cat
Archived copy: https://web.archive.org/web/20261010224910/https://lluismansilla.cat/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:27:13 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/1Wh4SQG/78db5e5295f1.png
  Captured: 2026-10-10 22:59:28 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a12809-3aa8-71a7-9142-8cde741e87d9.png
  Captured: 2026-10-10 22:59:28 UTC
  Source report: https://urlscan.io/result/01a12809-3aa8-71a7-9142-8cde741e87d9/
- URLScan capture 2: https://urlscan.io/screenshots/01a0c2fe-32f5-7774-86da-c156a2f95527.png
  Captured: 2026-10-10 22:45:32 UTC
  Source report: https://urlscan.io/result/01a12809-3aa8-71a7-9142-8cde741e87d9/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/02cc3de3-3376-461a-923c-9a7bdac22199.png
  Captured: 2026-10-12 11:31:06 UTC
  Source report: https://radar.cloudflare.com/scan/02cc3de3-3376-461a-923c-9a7bdac22199
  SHA-256: 44a16d89af092e2a730dd133dceddcea753f3a06e6dba460e329de6ab1b99911
- URLQuery: https://screenshots.phishdestroy.io/uq/2629a3ed-e702-4fbf-9307-825d07efcc8e.png
  Source report: https://urlquery.net/report/2629a3ed-e702-4fbf-9307-825d07efcc8e
  SHA-256: 4bf05f48966b01cf583ea18217f97df6e1b765650a3a71e5342541e92bd67e95
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c2fe-32f5-7774-86da-c156a2f95527.png
  Captured: 2026-09-21 08:04:08 UTC
  Source report: https://urlscan.io/result/01a0c2fe-32f5-7774-86da-c156a2f95527/
  SHA-256: 599f4a84efbc338f45d813a9d4616bbc69403bf9cd0efc8b006f67cd8e5b9b6b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:33:18Z",
        "uuid": "01a12809-3aa8-71a7-9142-8cde741e87d9",
        "scanned_at": "2026-10-10T22:57:45Z",
        "final_url": "https://lluismansilla.cat/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://lluismansilla.cat/",
                "from": "http://lluismansilla.cat/",
                "status": 307
            }
        ],
        "ip": "84.32.84.146",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.20.94",
            "142.250.154.95",
            "84.32.84.146"
        ],
        "asns": [
            "15169",
            "47583"
        ],
        "countries": [
            "US",
            "LT"
        ],
        "link_domains": [
            "www.linkedin.com",
            "instagram.com",
            "www.facebook.com",
            "twitter.com",
            "www.pinterest.com"
        ],
        "social": [
            "https://instagram.com/lluismansilla",
            "https://www.facebook.com/sharer/sharer.php",
            "https://twitter.com/intent/tweet"
        ],
        "doc_hash": "e67f67fff87fcc59537b75bad246732f16eff2b7cdcb9bd5033a8dda9a0f0af1",
        "script_hashes": [
            "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf",
            "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89",
            "f2cc60607c1d407e194dddc628e9fde74e56b9a60c4ba39d6b17a5e2629c83fb",
            "e1e1be1130a653a0c7a601fbd761d87b4f20f7c290d2215e89c54ba1f125f6c0",
            "0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34",
            "04037e019051b935551884b0a658ff54e14ecdcec7204567ab48ecf983092db3",
            "46e4d9b8174dc44d506feaeced04388139267ef274e7a26611c7d8dfcbd6f220",
            "85d6883af4c2977dfd6d6c96962013dcf0dd6138cae83b60bffffd43330de02e",
            "ff351c04e9e360135221f7c051943d99dfe23371846119d82d40c17c99340b84",
            "fd2d0ede26adc05f11c029cac6b79dd05987bee299d3746029fa14e62d678c2f"
        ],
        "globals": [
            "jQuery",
            "sbiajaxurl",
            "Modernizr",
            "getStyleProperty",
            "getSize",
            "eventie",
            "docReady",
            "EventEmitter",
            "matchesSelector",
            "Outlayer",
            "Masonry",
            "adjustIframes",
            "is_touch_device",
            "addComment",
            "_wpemojiSettings",
            "twemoji",
            "wp"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports"
        ],
        "tls": {
            "san": [
                "lluismansilla.cat",
                "www.lluismansilla.cat"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "lluismansilla.cat",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-25T22:02:55Z",
            "valid_from": "2026-09-26T22:02:56Z"
        },
        "domain_age_days": 2762,
        "apex_age_days": 2762,
        "tls_age_days": 14,
        "tls_valid_days": 89,
        "requests": 51,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -16,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "hcdn",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/7.4.33",
            "content-security-policy": "upgrade-insecure-requests"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:44:47Z",
        "uuid": "02cc3de3-3376-461a-923c-9a7bdac22199",
        "scanned_at": "2026-10-12T11:31:06Z",
        "final_url": "https://lluismansilla.cat/",
        "status": 200,
        "history": [
            {
                "url": "https://lluismansilla.cat/",
                "status": 200
            }
        ],
        "dom_hash": "644fc306baf239cfaf6a1473add74cfae5f0bde484a0a44caddabf292bbd7f80",
        "doc_hash": "e67f67fff87fcc59537b75bad246732f16eff2b7cdcb9bd5033a8dda9a0f0af1",
        "domain_risks": [
            "Photography",
            "Society & Lifestyle"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "lluismansilla.cat",
                "type": "A",
                "value": "2.57.91.125"
            },
            {
                "name": "lluismansilla.cat",
                "type": "A",
                "value": "88.222.222.67"
            },
            {
                "name": "lluismansilla.cat",
                "type": "AAAA",
                "value": "2a02:4780:84:bed0:93d1:7598:f440:7808"
            },
            {
                "name": "lluismansilla.cat",
                "type": "AAAA",
                "value": "2a02:4780:84:8199:856c:9c95:2bf2:614b"
            }
        ],
        "dnssec_valid": false,
        "ip": "2.57.91.125",
        "whois": {
            "registrar": "Nominalia",
            "created": "2019-03-11T16:04:40Z",
            "updated": "2026-04-25T17:02:48Z",
            "expires": "2027-03-11T16:04:40Z",
            "nameservers": [
                "ns1.dns-parking.com",
                "ns2.dns-parking.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T02:38:24Z",
        "analysis_at": "2026-10-17T00:38:09Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 3,
            "suspicious": 3,
            "undetected": 33
        },
        "detections": {
            "SOCRadar": "suspicious",
            "URLQuery": "suspicious",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "BitDefender": "blogs",
            "alphaMountain.ai": "Malicious (alphaMountain.ai)",
            "Xcitium Verdict Cloud": "parked sites",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "registrar": "NOMINALIA INTERNET S.L.",
        "created": "2019-03-11T16:04:40Z",
        "expires": "2027-03-11T16:04:40Z",
        "updated": "2026-04-25T17:02:48Z",
        "first_seen": "2023-09-29T17:13:09Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "dns.hostinger.com",
                "value": "ns1.dns-parking.com"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "mx1.hostinger.com",
                "priority": 5
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.dns-parking.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.dns-parking.com"
            },
            {
                "ttl": 60,
                "type": "AAAA",
                "value": "2a02:4780:4a:bf2:6176:c6c8:6289:f22a"
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "145.223.124.53"
            },
            {
                "ttl": 60,
                "type": "AAAA",
                "value": "2a02:4780:4d:2666:606c:f466:2947:5f9f"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 include:_spf.mail.hostinger.com ~all"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "mx2.hostinger.com",
                "priority": 10
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "147.79.79.53"
            }
        ],
        "dns_at": "2026-10-17T00:38:23Z",
        "jarm": "27d40d40d00040d00042d43d000000e1ea2a807a629b496b664cf07ad7c08d",
        "cert": {
            "san": [
                "lluismansilla.cat",
                "www.lluismansilla.cat"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "51d300059666e87f78cbf41c08c62ee09f1",
            "sha256": "f6672937949227220d2ac061399da8c00c75d6972642c05aeca4ad736108feeb",
            "subject": "lluismansilla.cat",
            "valid_to": "2026-12-25T22:02:55Z",
            "valid_from": "2026-09-26T22:02:56Z"
        },
        "whois": {
            "registrar": "NOMINALIA INTERNET S.L.",
            "registrar_iana_id": "76",
            "registrar_url": "http://www.nominalia.com",
            "created": "2019-03-11T00:00:00Z",
            "updated": "2026-04-13T00:00:00Z",
            "expires": "2027-03-11T00:00:00Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "ns1.dns-parking.com",
                "ns2.dns-parking.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "expiration": "2027-03-10T23:00:00Z",
                "last changed": "2026-04-12T22:00:00Z",
                "registration": "2019-03-10T23:00:00Z",
                "registrar expiration": "2027-03-10T23:00:00Z",
                "last update of RDAP database": "2026-10-16T02:00:29Z"
            }
        }
    }
}
```