# PhishDestroy domain threat record: ngersah.net Content language: English Canonical HTML report: https://phishdestroy.io/domain/ngersah.net/ Machine-readable companion: https://phishdestroy.io/domain/ngersah.net/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-22 13:04:24 UTC - Last availability or vendor check: 2026-10-22 13:10:42 UTC - Stored record updated: 2026-10-22 16:30:29 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: ScamSniffer - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 104.21.77.63 - Registrar in stored WHOIS data: Dominet (HK) Limited - Registrar country in stored WHOIS data: SG - Last stored HTTP status: 200 - Registration date (registry RDAP, ngersah.net): 2026-10-11 10:44:56 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a163bb-0edc-7750-a1c5-60821156aad5/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/ngersah.net - Certificate Transparency search: https://crt.sh/?q=%25.ngersah.net - Web Archive lookup: https://web.archive.org/web/*/https://ngersah.net/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added ngersah.net to its internal blocklist on 2026-10-22. The intake system flagged the domain because a URLScan capture taken on 2026-10-14 received a malicious verdict. An earlier AI assessment on the same day could not extract page content and therefore marked the verdict as unknown. An HTTP 200 response was recorded on 2026-10-22. How the scam works The URLScan capture taken on 2026-10-14 was classified as malicious, indicating the page may have been used for phishing, malware distribution, or other fraudulent activity. The capture did not contain identifiable page elements, so a specific technique could not be confirmed. Evidence VirusTotal scanned the domain on 2026-10-22 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked the same day and did not flag the domain. URLScan’s analysis dated 2026-10-14 labeled the page as malicious, and the external blocklist ScamSniffer also listed the domain as of 2026-10-22. OTX showed no pulses and PhishDestroy’s internal list marks the domain as blocked. Infrastructure The domain was registered on 2026-10-11 through Dominet (HK) Limited and is set to expire on 2027-10-11. DNS records observed on 2026-10-22 listed Cloudflare IP addresses 104.21.77.63 (Canada) and 172.67.205.32, along with IPv6 addresses 2606:4700:3037::6815:4d3f and 2606:4700:3034::ac43:cd20, and the domain used Cloudflare nameservers jonah.ns.cloudflare.com and suzanne.ns.cloudflare.com. The TLS certificate issued by Google Trust Services was valid from 2026-10-11 to 2027-01-09, and DNSSEC was not enabled. What to do Visitors should avoid entering credentials, personal data, or downloading files from the site and may clear cookies associated with it. Organizations should block ngersah.net at the network perimeter and review logs for any connections to the recorded IP addresses. Since no credential or wallet theft was confirmed, password resets or wallet revocations are only needed if users actually submitted sensitive information. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a163bb-0edc-7750-a1c5-60821156aad5/ Cloudflare Radar report: https://radar.cloudflare.com/scan/faca7b37-0347-4189-9bc2-d81e99f18b81 Stored capture screenshot: https://i.ibb.co/p6WzRSyd/dd615e6c6e7d.png Cloudflare Radar screenshot (2026-10-22T13:10:22Z): https://screenshots.phishdestroy.io/cf/faca7b37-0347-4189-9bc2-d81e99f18b81.png URLScan screenshot (2026-10-14T05:38:11Z): https://screenshots.phishdestroy.io/us/01a138ea-efae-762e-a488-042d221ac860.png URLScan capture report: https://urlscan.io/result/01a138ea-efae-762e-a488-042d221ac860/ VirusTotal report: https://www.virustotal.com/gui/domain/ngersah.net Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ngersah.net Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-22 13:18:49 UTC ## Stored page captures - Primary capture: https://i.ibb.co/p6WzRSyd/dd615e6c6e7d.png Captured: 2026-10-22 13:10:42 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a163bb-0edc-7750-a1c5-60821156aad5.png Captured: 2026-10-22 13:10:42 UTC Source report: https://urlscan.io/result/01a163bb-0edc-7750-a1c5-60821156aad5/ - URLScan capture 2: https://urlscan.io/screenshots/01a138ea-efae-762e-a488-042d221ac860.png Captured: 2026-10-22 13:04:24 UTC Source report: https://urlscan.io/result/01a163bb-0edc-7750-a1c5-60821156aad5/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/faca7b37-0347-4189-9bc2-d81e99f18b81.png Captured: 2026-10-22 13:10:22 UTC Source report: https://radar.cloudflare.com/scan/faca7b37-0347-4189-9bc2-d81e99f18b81 SHA-256: d4d6f77ff76bf3485d262cb2396f6fed1a075b20acdfd3427e0482585e6a99af - URLQuery: https://screenshots.phishdestroy.io/uq/79f1c852-2c94-44e0-9141-d124cf489589.png Source report: https://urlquery.net/report/79f1c852-2c94-44e0-9141-d124cf489589 SHA-256: b322c4572d72b98c73c102ccfc5026e7b4990e3caf21e58e8f945e9512ada73d - URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a138ea-efae-762e-a488-042d221ac860.png Captured: 2026-10-14 05:38:11 UTC Source report: https://urlscan.io/result/01a138ea-efae-762e-a488-042d221ac860/ SHA-256: 82f9473d57e77f980c9eb8df6048ff7cdd9b7f1d2204d292be1a09b2757c97fb - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163c6-ca8d-777d-857b-97819da29458.png Captured: 2026-10-22 13:22:33 UTC Source report: https://urlscan.io/result/01a163c6-ca8d-777d-857b-97819da29458/ SHA-256: a78d1412825049b39db864862a8f68acf93453408aed4ac9de810e75594a71df ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T14:30:17Z", "uuid": "01a163bb-0edc-7750-a1c5-60821156aad5", "scanned_at": "2026-10-22T13:09:32Z", "final_url": "https://ngersah.net/main.html", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://ngersah.net/", "from": "http://ngersah.net/", "status": 307 }, { "to": "https://ngersah.net/main.html", "from": "https://ngersah.net/" }, { "to": "https://ngersah.net/main.html", "from": "https://ngersah.net/main.html" } ], "ip": "172.67.205.32", "domains": [ "connect.facebook.net", "static.cloudflareinsights.com", "www.youtube.com", "www.walletlink.org", "mainnet.infura.io" ], "ips": [ "142.251.151.4", "157.240.8.23", "104.16.80.73", "172.67.205.32" ], "asns": [ "15169", "32934", "13335" ], "countries": [ "US", "AU" ], "link_domains": [ "app.readpeak.com", "g1.v.fwmrm.net", "ad2.trafficgate.net", "ad.letmeads.com", "www.stumbleupon.com", "telegram.me", "click.hotlog.ru", "hitcounter.ru", "top.mail.ru", "adserv.ontek.com.tr", "izlenzi.com", "www.installads.net", "xltube.nl", "bd742.com", "affiliazioniads.snai.it", "adserver.html.it", "pay4results24.eu", "axiabanners.exodus.gr", "interactive.forthnet.gr", "www.salidzini.lv", "ad.planbplus.co.kr", "adv.imadrep.co.kr", "promo.vador.com", "advmanager.techfun.pl", "www.trizer.pl", "afftrk.altex.ro", "blackfridaysales.ro", "event.2performant.com", "l.profitshare.ro", "febrare.ru" ], "social": [ "https://telegram.me/share/url" ], "doc_hash": "63f1eb36e4e000c9e36dab52c6ecb3f131b0dec0401753278ec20e18ae997b08", "script_hashes": [ "eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc", "c7f3811ce644c6029ab05ee97583c3277a0ea16ff153fbe2a288ac52da4e0ac9", "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "4fb5b08268ecf385c24d328b84879ea5a1277c3ed743eb0de77ae90d25e2bf8d", "52a79e58a318e8541687a08cd66f385d4741b3f9d511fdc5e6a0c4093d6b1dba", "1e57878e6981fee78ccfbda3edf3c0b5c3d609d1c7e0ec919c027835b2b1a1e5", "01d860123eb7ff90c82f70ed75a34a366b2b082d5795977576549b3b7b3fdddb", "c780b41594272bb9a747df6b85fdc4d8ae5468e1073278f9534409e477cdbdfd", "69b1496a4b846dac3beab7f4814e4bff8eb95b85277e2dbb8510ab4cc7f38206", "2bf13a5680417b12fe9b2062940b55fc1b412530673bd04b0c226006d30accaa" ], "globals": [ "__parseFunction", "Telegram", "fbq", "_fbq", "lastTouchEnd", "Module", "a960_0x406037", "a960_0x5585", "a960_0x3ee0", "webpackChunk", "a0_0x4852", "a0_0x1275", "_", "_iconfont_svg_string_4622698", "__cfBeacon" ], "cookies": [ "_fbp", "__Secure-YNID", "YSC", "VISITOR_INFO1_LIVE", "VISITOR_PRIVACY_METADATA", "__Secure-ROLLOUT_TOKEN", "__cf_bm" ], "storage_keys": [ "_Is_Incognit", "tradeActive", "done", "wagmi.store", "-walletlink:", "-walletlink:", "-walletlink:", "-walletlink:", "isDark", "navLeft", "serviceTime", "language" ], "tls": { "san": [ "ngersah.net", "www.ngersah.net", "*.www.ngersah.net" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "ngersah.net", "protocol": "QUIC", "valid_to": "2027-01-09T10:50:25Z", "valid_from": "2026-10-11T09:50:30Z" }, "domain_age_days": 9, "apex_age_days": 9, "tls_age_days": 11, "tls_valid_days": 90, "requests": 69, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 96, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T13:16:26Z", "uuid": "faca7b37-0347-4189-9bc2-d81e99f18b81", "scanned_at": "2026-10-22T13:10:22Z", "final_url": "https://ngersah.net/main.html", "status": 200, "history": [ { "url": "https://ngersah.net/", "status": 200 }, { "url": "https://ngersah.net/main.html", "status": 200 }, { "url": "https://ngersah.net/main.html", "status": 200 } ], "dom_hash": "5b34fc406d84fb33e510df072cf5135c6fbfc37c41299431dc46f8933a78492a", "doc_hash": "63f1eb36e4e000c9e36dab52c6ecb3f131b0dec0401753278ec20e18ae997b08", "phishing_v2": [ "phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "ngersah.net", "type": "A", "value": "104.21.77.63" }, { "name": "ngersah.net", "type": "A", "value": "172.67.205.32" }, { "name": "ngersah.net", "type": "AAAA", "value": "2606:4700:3037::6815:4d3f" }, { "name": "ngersah.net", "type": "AAAA", "value": "2606:4700:3034::ac43:cd20" } ], "dnssec_valid": false, "ip": "104.21.77.63", "whois": { "registrar": "Dominet (HK) Limited", "created": "2026-10-11T10:44:56Z", "updated": "2026-10-11T10:47:35Z", "expires": "2027-10-11T10:44:56Z", "nameservers": [ "jonah.ns.cloudflare.com", "suzanne.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T13:09:39Z", "analysis_at": "2026-10-22T04:01:56Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "Dominet (HK) Limited", "created": "2026-10-11T10:44:56Z", "expires": "2027-10-11T10:44:56Z", "updated": "2026-10-11T10:47:35Z", "first_seen": "2026-10-11T12:15:50Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "jonah.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "jonah.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "suzanne.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.205.32" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::ac43:cd20" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:4d3f" }, { "ttl": 300, "type": "A", "value": "104.21.77.63" } ], "dns_at": "2026-10-22T04:02:17Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "ngersah.net", "www.ngersah.net", "*.www.ngersah.net" ], "issuer": "Google Trust Services / WE1", "serial": "2874ef9ab3483411371b4195eea93a3", "sha256": "6b7f1d0ac5b184a868d76da3cf1346e4f819cc0c350540e6c20efe93697f711a", "subject": "ngersah.net", "valid_to": "2027-01-09T10:50:25Z", "valid_from": "2026-10-11T09:50:30Z" }, "whois": { "registrar": "Dominet (HK) Limited", "registrar_iana_id": "3775", "registrar_url": "http://www.alibabacloud.com", "created": "2026-10-11T10:44:56Z", "updated": "2026-10-11T10:44:56Z", "expires": "2027-10-11T10:44:56Z", "status": [ "ok" ], "nameservers": [ "jonah.ns.cloudflare.com", "ns1.domainnamens.com", "ns2.domainnamens.com", "suzanne.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "active" ], "events": { "expiration": "2027-10-11T10:44:56Z", "registration": "2026-10-11T10:44:56Z", "registrar expiration": "2027-10-11T10:44:56Z", "last update of RDAP database": "2026-10-11T10:44:57Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-22T13:18:16Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "ngersah.net" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-22T13:09:39Z", "first": "2026-10-11T12:20:22Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.09, "avg_page_bytes": 2441 }, "sitemap": { "present": true, "url_count": 1 }, "social_tags": { "themeColor": "#ffffff" }, "trackers": { "requests": 0 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 8, "tls": 73, "wait": 1940, "connect": 7, "download": 0 }, "response_ms": 2028 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 9909, "co2_grams": 0.0004, "cleaner_than": 72 }, "dns_server": { "ns": [ { "ip": "172.64.34.87", "host": "suzanne.ns.cloudflare.com" }, { "ip": "173.245.59.186", "host": "jonah.ns.cloudflare.com" } ], "zone": "ngersah.net" }, "cookies": { "cookies": [ { "name": "__Secure-YNID", "secure": true, "http_only": true, "same_site": "None" }, { "name": "YSC", "secure": true, "session": true, "http_only": true, "same_site": "None" }, { "name": "__Secure-ROLLOUT_TOKEN", "secure": true, "http_only": true, "same_site": "None" }, { "name": "VISITOR_INFO1_LIVE", "secure": true, "http_only": true, "same_site": "None" }, { "name": "VISITOR_PRIVACY_METADATA", "secure": true, "http_only": true, "same_site": "None" }, { "name": "_fbp", "same_site": "Lax" }, { "name": "__cf_bm", "secure": true, "http_only": true, "same_site": "None" }, { "name": "__cf_bm", "secure": true, "http_only": true, "same_site": "None" }, { "name": "__cf_bm", "secure": true, "http_only": true, "same_site": "None" } ] }, "location": { "ip": "2606:4700:3037::6815:4d3f", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "ngersah.net" }, "dns": { "A": [ "104.21.77.63", "172.67.205.32" ], "NS": [ "jonah.ns.cloudflare.com", "suzanne.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"jonah.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417215025, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3034::ac43:cd20", "2606:4700:3037::6815:4d3f" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3034::ac43:cd20", "family": 6 }, "redirects": { "chain": [ "https://ngersah.net" ] }, "tech_stack": { "technologies": [ "FingerprintJS", "crypto-js", "Cloudflare", "HTTP/3" ] }, "whois": { "registrar": "Dominet (HK) Limited", "created": "2026-10-11T10:44:56Z", "updated": "2026-10-11T10:47:35Z", "expires": "2027-10-11T10:44:56Z", "status": [ "ok https://icann.org/epp" ], "nameservers": [ "jonah.ns.cloudflare.com", "suzanne.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html" } } } } ```