# PhishDestroy domain threat record: nicole-martin.accessadmin.co.za Content language: English Canonical HTML report: https://phishdestroy.io/domain/nicole-martin.accessadmin.co.za/ Machine-readable companion: https://phishdestroy.io/domain/nicole-martin.accessadmin.co.za/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-11 11:32:28 UTC - Last availability or vendor check: 2026-10-22 10:06:47 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 16/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 196.41.127.26 - Registrar in stored WHOIS data: Cybersmart Ltd - Last stored HTTP status: 403 - Registration date in stored WHOIS data: 2009-02-20 07:27:25 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a11bbc-ce92-752f-8f6c-47616b7da12e/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/nicole-martin.accessadmin.co.za - Certificate Transparency search: https://crt.sh/?q=%25.nicole-martin.accessadmin.co.za - Web Archive lookup: https://web.archive.org/web/*/https://nicole-martin.accessadmin.co.za/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview nicole-martin.accessadmin.co.za is a domain on the PhishDestroy blocklist. It first appeared on our radar on 2026-10-11. The address puts a personal name in front of a parent domain built around the word "accessadmin". No specific brand or target audience has been confirmed. As of 2026-10-19 the site was still online, with its content reachable but sitting behind an access barrier. How the scam works Visitors currently see a page titled "403 Forbidden", a standard access-denied message, while the domain is listed as suspicious. That title does not show what the host serves to other visitors or under other conditions. The real risk comes from the vendor detections described below. A domain flagged by this many security engines should be treated as a possible source of phishing or malicious content. Do not trust any login form, download or wallet prompt it presents. Evidence One day after we first saw the domain, on 2026-10-12, 16 of 92 VirusTotal engines classified it as malicious or suspicious. The vendors that flagged it include Kaspersky, Fortinet, Forcepoint ThreatSeeker, Emsisoft, Gridinsoft, alphaMountain.ai, CRDF and Ermes. These are independent vendors using different detection methods, so their agreement carries more weight than any single verdict. Apart from PhishDestroy's own listing, the domain does not appear on other blocklists. Infrastructure The site resolves to 196.41.127.26 on the Cybersmart network in South Africa, which fits the .co.za domain. It uses a free, automatically issued Let's Encrypt certificate, so the browser padlock only means the connection is encrypted. It says nothing about who runs the site or whether it is safe. Because the threat sits on a named subdomain, the parent domain may host other subdomains that have not yet been assessed. What to do If you entered a username, password or any personal details on this site, change that password right away. Also change it on every other service where you reused it, and turn on two-factor authentication. Check those accounts for logins or changes you do not recognise. If you downloaded anything from the site, run a full malware scan before you open the file. Security teams should block the domain and its IP at the DNS and proxy level, and search their logs for traffic to it from 2026-10-11 onward. They should also watch other subdomains of accessadmin.co.za for related activity. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a11bbc-ce92-752f-8f6c-47616b7da12e/ VirusTotal report: https://www.virustotal.com/gui/domain/nicole-martin.accessadmin.co.za Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=nicole-martin.accessadmin.co.za Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:39:11 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a11bbc-ce92-752f-8f6c-47616b7da12e.png Captured: 2026-10-11 11:32:28 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a11bbc-ce92-752f-8f6c-47616b7da12e.png Source report: https://urlscan.io/result/01a11bbc-ce92-752f-8f6c-47616b7da12e/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/900cc896-d2af-4f75-a0e5-2ef9c3a6adcc.png Captured: 2026-10-12 10:06:58 UTC Source report: https://radar.cloudflare.com/scan/900cc896-d2af-4f75-a0e5-2ef9c3a6adcc SHA-256: 088ec3317c4ddf7868d3510312544e05e8dec27b104765bbefb80cbc4314faa9 - URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a297-0637-722f-b9e9-9c3aa4303303.png Captured: 2026-09-15 01:03:30 UTC Source report: https://urlscan.io/result/01a0a297-0637-722f-b9e9-9c3aa4303303/ SHA-256: c9045d1a88f5f4a26eac3cadc51741a3e388311e70ebf8b0f675f9ecdbdad72d - URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c280-f1f2-76be-bb50-f757b2a30566.png Captured: 2026-09-21 05:47:51 UTC Source report: https://urlscan.io/result/01a0c280-f1f2-76be-bb50-f757b2a30566/ SHA-256: f199c7834511d97a5b7f6bb4ac9a37052a55690b8f1e079df34da635d3877f18 - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1423a-a2ac-73e9-b374-4fb95d84dd53.png Captured: 2026-10-16 01:01:48 UTC Source report: https://urlscan.io/result/01a1423a-a2ac-73e9-b374-4fb95d84dd53/ SHA-256: f199c7834511d97a5b7f6bb4ac9a37052a55690b8f1e079df34da635d3877f18 - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1429b-a61a-7112-acdd-79c266eae695.png Captured: 2026-10-16 02:47:45 UTC Source report: https://urlscan.io/result/01a1429b-a61a-7112-acdd-79c266eae695/ SHA-256: f199c7834511d97a5b7f6bb4ac9a37052a55690b8f1e079df34da635d3877f18 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T17:52:43Z", "uuid": "01a11bbc-ce92-752f-8f6c-47616b7da12e", "scanned_at": "2026-10-08T13:38:52Z", "final_url": "https://nicole-martin.accessadmin.co.za/", "status": 403, "redirected": "https-only", "redirects": [ { "to": "https://nicole-martin.accessadmin.co.za/", "from": "http://nicole-martin.accessadmin.co.za/", "status": 307 } ], "ip": "196.41.127.26", "ptr": "cpanel30.mywebserver.co.za", "ips": [ "196.41.127.26" ], "asns": [ "36874" ], "countries": [ "ZA" ], "doc_hash": "415ff807abb2fd49ce840d67bf14cb4d647e78afa9ab115c2b2dd8c8614928dd", "tls": { "san": [ "*.accessadmin.co.za", "accessadmin.co.za" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "accessadmin.co.za", "protocol": "TLS 1.3", "valid_to": "2026-11-08T23:13:04Z", "valid_from": "2026-08-10T23:13:05Z" }, "domain_age_days": 23, "apex_age_days": 1949, "tls_age_days": 58, "tls_valid_days": 89, "requests": 2, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -19, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html; charset=iso-8859-1" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T18:03:23Z", "uuid": "900cc896-d2af-4f75-a0e5-2ef9c3a6adcc", "scanned_at": "2026-10-12T10:06:58Z", "final_url": "https://nicole-martin.accessadmin.co.za/", "status": 403, "history": [ { "url": "https://nicole-martin.accessadmin.co.za/", "status": 403 } ], "dom_hash": "bb733a120564c069f4fd5e59c0196c1c2466dc5b09e96a2bc113da5d7249fff1", "doc_hash": "415ff807abb2fd49ce840d67bf14cb4d647e78afa9ab115c2b2dd8c8614928dd", "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "nicole-martin.accessadmin.co.za", "type": "A", "value": "196.41.127.26" } ], "dnssec_valid": false, "ip": "196.41.127.26", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "Cybersmart Ltd", "created": "2009-02-20T08:27:25Z", "updated": "2025-12-05T09:14:27Z", "expires": "2027-02-20T08:27:25Z", "nameservers": [ "ns1.mywebserver.co.za", "ns2.mywebserver.co.za", "ns3.mywebserver.co.za" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T00:29:24Z", "analysis_at": "2026-10-13T02:17:13Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 16, "suspicious": 1, "undetected": 31 }, "detections": { "CRDF": "malicious", "Ermes": "not recommended", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "URLQuery": "malicious", "Kaspersky": "phishing", "LevelBlue": "phishing", "Gridinsoft": "phishing", "MalwareURL": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "Cybersmart Ltd", "created": "2009-02-20T08:27:25Z", "expires": "2027-02-20T08:27:25Z", "updated": "2025-12-05T09:14:27Z", "first_seen": "2026-09-14T18:14:20Z", "dns": [ { "ttl": 14400, "type": "TXT", "value": "v=spf1 +a +mx +ip4:196.41.127.26 include:spamkill.cybersmart.co.za ~all" }, { "ttl": 14400, "type": "A", "value": "196.41.127.26" } ], "dns_at": "2026-10-13T02:22:57Z", "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b", "cert": { "san": [ "*.accessadmin.co.za", "accessadmin.co.za" ], "issuer": "Let's Encrypt / YR1", "serial": "63def65a91143adbbb587795b570c6468b2", "sha256": "b88bec8da7533dbf814cad0d7c52e952728bbc303c9736365d318af58a68beee", "subject": "*.accessadmin.co.za", "valid_to": "2027-01-08T23:14:15Z", "valid_from": "2026-10-10T23:14:16Z" }, "whois": { "registrar": "Cybersmart Ltd", "registrar_url": "www.cybersmart.co.za", "created": "2009-02-20T08:27:25Z", "updated": "2025-12-05T09:14:27Z", "expires": "2027-02-20T08:27:25Z", "status": [ "ok" ], "nameservers": [ "ns1.mywebserver.co.za", "ns2.mywebserver.co.za", "ns3.mywebserver.co.za" ], "dnssec": "unsigned" } } } ```