# occultresearch.org — Occult Research Observatory Landing Page | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/occultresearch.org/ Machine-readable companion: https://phishdestroy.io/domain/occultresearch.org/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: Last known active - First observed by PhishDestroy: 2026-11-01 08:17:15 UTC - Selected availability observation: 2026-11-02T23:21:56Z - Stored record updated: 2026-11-03 07:23:35 UTC - VirusTotal detections in the stored snapshot: 2/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored infrastructure - Observed IP address: 104.21.57.186 - Registrar in stored WHOIS data: Name.com, Inc. - Last stored HTTP status: 200 (observed: 2026-11-02T23:21:56Z) - Registration date in stored WHOIS data: 2026-07-23 17:53:51 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a19637-2372-74aa-ab28-e5247cef714b/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/occultresearch.org - Certificate Transparency search: https://crt.sh/?q=%25.occultresearch.org - Web Archive lookup: https://web.archive.org/web/*/https://occultresearch.org/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy records the captured occultresearch.org landing page, which presents two research instruments on divination and esoteric technology. The captured occultresearch.org page is a landing page for "The Observatory," presenting the site's claim to study divination as an empirical subject. It introduces two instruments — a Divination Data Lab running live experiments and an Occult Origins of Technology section tracing lineages from esoteric practice to modern technology — with a "TAKE PART" button as the main call to action. The stored VirusTotal domain result reports 2 detections out of 92 engines. SOCRadar reported "phishing"; Gridinsoft reported "suspicious". Package revision: 85f30894bfb6c9c1d48f46df0ac1102dae51b1c630e8a6e44208f31c608f82f7 Text generated (not scan time): 2026-11-01 09:25:31 Reviewed evidence snapshot: {"domain":"occultresearch.org","screenshot_available":true,"initial_ai_description":"Site returned a 403 Forbidden error and a Cloudflare challenge page, preventing content assessment.","initial_ai_description_kind":"previous AI opinion, not independent evidence","virustotal":{"detections":2,"engines":92,"malicious":1,"suspicious":1,"retrieved_date":"2026-11-01","analysis_date":"2026-11-01","flagging_vendors":["SOCRadar","Gridinsoft"],"vendor_labels":{"SOCRadar":"phishing","Gridinsoft":"suspicious"},"scope":"domain"},"capture_context":{"relationship":"screenshot associated with this domain record","captured_at":"2026-11-01T08:22:59Z"},"virustotal_public_summary":"The stored VirusTotal domain result reports 2 detections out of 92 engines. SOCRadar reported \"phishing\"; Gridinsoft reported \"suspicious\".","page_paragraph_target_characters":509} Source facts (timestamps as stored): {"record_id":1728707,"first_recorded_at":"2026-11-01 09:17:15","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":2,"denominator":92,"malicious":1,"suspicious":1,"vendors":{"SOCRadar":"phishing","Gridinsoft":"suspicious"},"observed_at":"2026-11-01T06:32:38Z","checked_at":null,"fetched_at":"2026-11-01T08:18:48Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":2,"denominator":92,"malicious":null,"suspicious":null,"vendors":["Gridinsoft","SOCRadar"],"observed_at":"2026-11-01 06:32:38","checked_at":"2026-11-01 09:18:58","fetched_at":"2026-11-01 08:18:58","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"SOCRadar":"phishing","Gridinsoft":"suspicious"},"vendor_names":["SOCRadar","Gridinsoft"],"stats":{"timeout":0,"harmless":55,"malicious":1,"suspicious":1,"undetected":35}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-02 12:02:20"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-11-01 12:37:17"},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"current_http_probe","record_id":1728707,"scope":"checked_url","observed_at":"2026-11-02T23:21:56Z","http_status":200,"http_observed_at":"2026-11-02T23:21:56Z","stored_http_code":200,"stored_http_observed_at":"2026-11-02T23:21:56Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"served_at_root","content_classification_at":"2026-11-02T11:53:21Z","registration_state":"unknown","policy":"20261102-dated-availability-v2"}} ## Stored page captures - URLScan · 2026-11-01: https://screenshots.phishdestroy.io/01a19637-2372-74aa-ab28-e5247cef714b.png Captured: 2026-11-01 08:26:04 UTC Source report: https://urlscan.io/result/01a19637-2372-74aa-ab28-e5247cef714b/ - URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e8db-7092-7174-be49-8a5dc9829a5b.png Captured: 2026-09-28 16:31:37 UTC Source report: https://urlscan.io/result/01a0e8db-7092-7174-be49-8a5dc9829a5b/ SHA-256: 36453c1aa7e8c590302c29a4e4bef31a9a9a4bb68c126e242a85a113bd3d0709 - URLScan · 2026-05-06: https://screenshots.phishdestroy.io/us/019dfd89-4229-734c-94f7-5904d93548d9.png Captured: 2026-05-06 13:45:29 UTC Source report: https://urlscan.io/result/019dfd89-4229-734c-94f7-5904d93548d9/ SHA-256: 4a4697f6bf8e04eb88f48727552946ca2b9bcdefa0f2c9f52a4823fcfc85fe32 - URLScan · 2026-05-07: https://screenshots.phishdestroy.io/us/019e01ac-6c74-76a9-86c5-8640f3ccb582.png Captured: 2026-05-07 09:02:23 UTC Source report: https://urlscan.io/result/019e01ac-6c74-76a9-86c5-8640f3ccb582/ SHA-256: 4a4697f6bf8e04eb88f48727552946ca2b9bcdefa0f2c9f52a4823fcfc85fe32 - URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a429-49f3-71a5-88ae-1e5af41e0ae8.png Captured: 2026-09-15 08:22:54 UTC Source report: https://urlscan.io/result/01a0a429-49f3-71a5-88ae-1e5af41e0ae8/ SHA-256: f6c3d8eb4e1be9718db83a62e353326aa6a57c68c78e3911333f463b0b43c0cf - URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0aeb1-519a-7711-80d0-de3b234e7fe7.png Captured: 2026-09-17 09:27:37 UTC Source report: https://urlscan.io/result/01a0aeb1-519a-7711-80d0-de3b234e7fe7/ SHA-256: f6c3d8eb4e1be9718db83a62e353326aa6a57c68c78e3911333f463b0b43c0cf - URLScan · 2026-11-01: https://screenshots.phishdestroy.io/us/01a19634-4c26-75d7-b1d0-621b3336dbe7.png Captured: 2026-11-01 08:22:59 UTC Source report: https://urlscan.io/result/01a19634-4c26-75d7-b1d0-621b3336dbe7/ SHA-256: 6770298b7d7d90625d62b4bc187e244deddc1e1f264c5ad5d3ef84b23f835911 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/fb070a10-aef4-4057-98ca-5e0d224b858c.png Captured: 2026-11-01 08:20:40 UTC Source report: https://radar.cloudflare.com/scan/fb070a10-aef4-4057-98ca-5e0d224b858c SHA-256: 003d188376be35cc87eb8c3f0cb347693b50a4b97ce51727010556312acda198 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-11-01T08:31:42Z", "uuid": "01a19637-2372-74aa-ab28-e5247cef714b", "scanned_at": "2026-11-01T08:26:04Z", "final_url": "https://occultresearch.org/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://occultresearch.org/", "from": "http://occultresearch.org/", "status": 307 } ], "ip": "172.67.165.117", "domains": [ "stats.szram.uk" ], "ips": [ "172.67.176.238", "172.67.165.117" ], "asns": [ "13335" ], "doc_hash": "e8f39792cc8c27f1a86378602793af237b75698f95c3310ca2bbdc1a37847ecb", "script_hashes": [ "a4f6edb820f191c217eb5489f058b0cdc7b7872fbeaf09020475041d3ddcb447", "cd8e8b5b5f9a280bd64064eca10fc2ac616a4a0f14ede9ef39e880ac13c39f78", "cf6686aed376d01679be0b62ec73f51f9d37a93c4acbd43da982b0514c8d1df4", "70351ff6403c4a848ee47c0831bfad1862a84e2391631f94c75717efc0462e50", "5a501ad9bf68057c4883c70f6ca11360cbb6dab61cc4af4ac51ea7966e05ac56", "b5f9b5199b99ab6c141f4540f0b7d0fe803c4ecf6956849ecb6e59d3d439272e", "42c501b2846c8ccdaae12148388d5d83d3138c9506b1a4435d0283455dcdaa7d", "68e74fa08027ce9ec4dbcb7caa27688667ff4fcca39ea31a06906c755fb70bf2", "a6ebbb0ee0bc3f5e2fe469a71c3d64172c3abe5be4d98c0140d8a170dd52b62f", "c693f59f87a3b18bb6df196621e0a6d17e01d7b678d0864c896ea9779fddac04" ], "globals": [ "TURBOPACK", "__next_f", "next", "__webpack_hash__", "orUmamiBeforeSend", "umami" ], "cookies": [ "cf_clearance" ], "tls": { "san": [ "*.occultresearch.org", "occultresearch.org" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "occultresearch.org", "protocol": "QUIC", "valid_to": "2027-01-22T17:39:02Z", "valid_from": "2026-10-24T17:39:03Z" }, "domain_age_days": 2180, "apex_age_days": 2180, "tls_age_days": 7, "tls_valid_days": 89, "requests": 24, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 1, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; script-src 'self' 'unsafe-inline' https://stats.szram.uk; style-src 'self' 'unsafe-inline'; img-src ", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()", "cross-origin-opener-policy": "same-origin", "priority": "u=0,i" } }, "cf": { "v": 1, "fetched_at": "2026-11-01T08:24:47Z", "uuid": "fb070a10-aef4-4057-98ca-5e0d224b858c", "scanned_at": "2026-11-01T08:20:40Z", "final_url": "https://occultresearch.org/", "status": 200, "history": [ { "url": "https://occultresearch.org/", "status": 200 } ], "dom_hash": "dec65b66c31262cca50f8cc39ec95ae9714f622b89ae9c5be5ba9ea889bc76bb", "doc_hash": "6893f93796981341e9e9d1d98333ee290036718d0cedbf1625b25093c36afb15", "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "occultresearch.org", "type": "A", "value": "104.21.57.186" }, { "name": "occultresearch.org", "type": "A", "value": "172.67.165.117" }, { "name": "occultresearch.org", "type": "AAAA", "value": "2606:4700:3034::6815:39ba" }, { "name": "occultresearch.org", "type": "AAAA", "value": "2606:4700:3035::ac43:a575" } ], "dnssec_valid": false, "ip": "127.0.1.20", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Name.com, Inc.", "created": "2026-07-23T19:53:51Z", "updated": "2026-10-24T18:25:30Z", "expires": "2027-07-23T19:53:51Z", "nameservers": [ "ara.ns.cloudflare.com", "miguel.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-11-01T08:18:48Z", "analysis_at": "2026-11-01T06:32:38Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 1, "suspicious": 1, "undetected": 35 }, "detections": { "SOCRadar": "phishing", "Gridinsoft": "suspicious" }, "reputation": 0, "popularity": { "Cisco Umbrella": 636007 }, "registrar": "Name.com, Inc.", "created": "2026-07-23T19:53:51Z", "expires": "2027-07-23T19:53:51Z", "updated": "2026-08-12T09:16:55Z", "first_seen": "2023-11-21T10:55:49Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::6815:39ba" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 include:_spf.purelymail.com -all" }, { "ttl": 300, "type": "CAA", "value": "sectigo.com" }, { "ttl": 300, "type": "TXT", "value": "purelymail_ownership_proof=9e924b61424c1398a5cee69cc3e57adb34dd2fb55c002a2455d1305c0d50d4f388aabfc0d8277c2c40e47c30a192c8d37c5f50fef690766f62850ea40696ca9f" }, { "ttl": 300, "type": "CAA", "value": "letsencrypt.org" }, { "ttl": 21600, "type": "NS", "value": "miguel.ns.cloudflare.com" }, { "ttl": 300, "type": "CAA", "value": "ssl.com" }, { "ttl": 300, "type": "CAA", "value": "pki.goog;" }, { "ttl": 300, "type": "CAA", "value": "comodoca.com" }, { "ttl": 300, "type": "CAA", "value": "digicert.com;" }, { "ttl": 300, "type": "MX", "value": "mailserver.purelymail.com", "priority": 50 }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "ara.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=VMvClv0u_gFNp541FAeO7ou_RH_jCzGeP_U5nzDsTOA" }, { "ttl": 300, "type": "CAA", "value": "ssl.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::ac43:a575" }, { "ttl": 300, "type": "CAA", "value": "letsencrypt.org" }, { "ttl": 300, "type": "CAA", "value": "pki.goog;" }, { "ttl": 300, "type": "A", "value": "172.67.165.117" }, { "ttl": 300, "type": "CAA", "value": "digicert.com;" }, { "ttl": 300, "type": "CAA", "value": "comodoca.com" }, { "ttl": 21600, "type": "NS", "value": "ara.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.57.186" } ], "dns_at": "2026-11-01T07:39:17Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "*.occultresearch.org", "occultresearch.org" ], "issuer": "Let's Encrypt / YE2", "serial": "5982f5e75790c9fce40f6300024e208b695", "sha256": "8ffc452b2c3254bd2035101c1d8e32f6cc3d9f1b08de85d78b4fdb731d5e67bc", "subject": "occultresearch.org", "valid_to": "2027-01-22T17:39:02Z", "valid_from": "2026-10-24T17:39:03Z" }, "whois": { "registrar": "Name.com, Inc.", "registrar_iana_id": "625", "registrar_url": "http://www.name.com", "created": "2026-07-23T19:53:51Z", "updated": "2026-08-12T09:16:55Z", "expires": "2027-07-23T19:53:51Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1.vercel-dns.com", "ns2.vercel-dns.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-07-23T19:53:51Z", "last changed": "2026-10-24T18:25:30Z", "registration": "2026-07-23T19:53:51Z", "registrar expiration": "2027-07-23T19:53:51Z", "last update of RDAP database": "2026-10-24T18:25:30Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-11-01T08:24:58Z", "mail_config": { "mx": [ "mailserver.purelymail.com" ], "spf": "v=spf1 include:_spf.purelymail.com -all", "dmarc": true, "spf_lookups": 1 }, "caa_records": { "count": 11, "domain": "occultresearch.org", "issuers": [ "pki.goog; cansignhttpexchanges=yes", "sectigo.com", "ssl.com", "comodoca.com", "digicert.com; cansignhttpexchanges=yes", "letsencrypt.org" ] }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-11-01T08:20:08Z", "first": "2001-07-20T05:39:06Z", "changes": 127, "days_archived": 257, "scans_per_day": 0.03, "avg_page_bytes": 5649 }, "robots_txt": { "present": true, "llms_txt": true, "sitemaps": [ "https://occultresearch.org/sitemap.xml" ] }, "security_txt": { "present": true, "found_in": "/.well-known/security.txt" }, "trackers": { "requests": 46 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "dns_server": { "ns": [ { "ip": "173.245.58.67", "host": "ara.ns.cloudflare.com" }, { "ip": "162.159.44.95", "host": "miguel.ns.cloudflare.com" } ], "zone": "occultresearch.org" }, "location": { "ip": "2606:4700:3035::ac43:a575", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "occultresearch.org" }, "dns": { "A": [ "104.21.57.186", "172.67.165.117" ], "MX": [ "{\"exchange\": \"mailserver.purelymail.com\", \"priority\": 50}" ], "NS": [ "ara.ns.cloudflare.com", "miguel.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"ara.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418396477, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "purelymail_ownership_proof=9e924b61424c1398a5cee69cc3e57adb34dd2fb55c002a2455d1305c0d50d4f388aabfc0d8277c2c40e47c30a192c8d37c5f50fef690766f62850ea40696ca9f", "v=spf1 include:_spf.purelymail.com -all", "google-site-verification=VMvClv0u_gFNp541FAeO7ou_RH_jCzGeP_U5nzDsTOA" ], "AAAA": [ "2606:4700:3035::ac43:a575", "2606:4700:3034::6815:39ba" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3035::ac43:a575", "family": 6 }, "whois": { "registrar": "Name.com, Inc.", "created": "2026-07-23T19:53:51Z", "updated": "2026-10-24T18:25:30Z", "expires": "2027-07-23T19:53:51Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ara.ns.cloudflare.com", "miguel.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "content-security-policy": "default-src 'none'; script-src 'nonce-J5dXEA4gVeCITVeIliWxdV' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenge", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "same-origin", "permissions-policy": "accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*", "cross-origin-opener-policy": "same-origin", "cross-origin-resource-policy": "same-origin", "cross-origin-embedder-policy": "require-corp" } } } } ``` Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/us/01a19634-4c26-75d7-b1d0-621b3336dbe7.png","source":"URLScan","report_url":"https://urlscan.io/result/01a19634-4c26-75d7-b1d0-621b3336dbe7/","captured_at":"2026-11-01T08:22:59Z","sha256":"6770298b7d7d90625d62b4bc187e244deddc1e1f264c5ad5d3ef84b23f835911","model_image_sha256":"0336f1d03501ad88ca347e3033652a9414628fe5c7812cff7c9f2081a4634a1a","available":true,"content_status":null} ## Complete dated records Availability observations: https://phishdestroy.io/domain/occultresearch.org/records.json?source=availability&format=json Source observation history: https://phishdestroy.io/domain/occultresearch.org/records.json?source=detections&format=json PhishStats records: https://phishdestroy.io/domain/occultresearch.org/records.json?source=phishstats&format=json Sent report records: https://phishdestroy.io/domain/occultresearch.org/records.json?source=sent_reports&format=json Report history: https://phishdestroy.io/domain/occultresearch.org/records.json?source=report_history&format=json Repeat report records: https://phishdestroy.io/domain/occultresearch.org/records.json?source=rereports&format=json Follow-up records: https://phishdestroy.io/domain/occultresearch.org/records.json?source=followups&format=json Content observations: https://phishdestroy.io/domain/occultresearch.org/records.json?source=content&format=json ## Dated availability observation Latest stored reachability observation ```json { "state": "alive", "label_key": "availability.active", "detail_key": "detail.latest_reachability", "params": [], "source": "current_http_probe", "record_id": 1728707, "scope": "checked_url", "observed_at": "2026-11-02T23:21:56Z", "http_status": 200, "http_observed_at": "2026-11-02T23:21:56Z", "stored_http_code": 200, "stored_http_observed_at": "2026-11-02T23:21:56Z", "legacy_site_status": "alive", "supports_outcome_badge": false, "content_classification": "served_at_root", "content_classification_at": "2026-11-02T11:53:21Z", "registration_state": "unknown", "policy": "20261102-dated-availability-v2" } ```