# PhishDestroy domain threat record: onstrmapk.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/onstrmapk.com/ Machine-readable companion: https://phishdestroy.io/domain/onstrmapk.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 01:37:48 UTC - Last availability or vendor check: 2026-10-28 00:13:00 UTC - Stored record updated: 2026-10-28 00:13:00 UTC - VirusTotal detections in the stored snapshot: 7/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: disney+ ## Stored infrastructure - Observed IP address: 156.67.222.102 - Registrar in stored WHOIS data: OpusDNS GmbH - Last stored HTTP status: 200 - Registration date (registry RDAP, onstrmapk.com): 2026-09-04 03:48:02 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a166c6-2dce-708a-bcc2-df94a71ee5a0/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/onstrmapk.com - Certificate Transparency search: https://crt.sh/?q=%25.onstrmapk.com - Web Archive lookup: https://web.archive.org/web/*/https://onstrmapk.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview The captured screenshot shows an English-language page headed OnStream APK Download for android (latest version 2026), with a prominent purple Download OnStream APK button and copy promising movies, TV shows, web series, anime, live channels and sports without a monthly subscription. A panel labeled What is OnStream APK? describes a third-party streaming application and stated the site was an independent guide rather than the official developer. PhishDestroy classified the page as an impersonation phishing page and first saw the domain on 2026-10-23. How the scam works The page funnels Android visitors toward sideloading an OnStream APK from an external file host, explicitly noting the app is unavailable on Google Play and must be downloaded and installed manually. As a category risk, this pattern turns an entertainment offer into an unvetted software installation outside any app-store review. Visitors therefore trade a free-streaming lure for code whose provenance the page cannot establish. Evidence The screenshot shows the download button, the no-subscription offer, and the disclaimer that the site was an independent guide rather than the official developer; VirusTotal did not flag it. On 2026-10-23 urlscan's machine-learning engine scored the page malicious at 99 while its overall verdict remained clean, and Cloudflare Radar tagged it malicious under DGA domains. Spamhaus recorded no listing, Google Safe Browsing showed no flag, OTX held 0 pulses, while the MetaMask and SEAL blocklists plus PhishDestroy's internal list carried the domain when checked on 2026-10-26. The capture logged a 307 redirect from HTTP to HTTPS, a LiteSpeed and PHP runtime on WordPress with no third-party trackers, and 3 distinct script SHA256 hashes recorded for pivoting (38bf4f385d34). Infrastructure Notable weaknesses lead: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP are all absent, Content-Security-Policy carries only upgrade-insecure-requests, and DNSSEC is unsigned. Registration was created on 2026-09-04 through OpusDNS GmbH and recorded on Hostinger International Limited's network; TLS 1.3 with TLS-AES-256-GCM-SHA384, forward secrecy and ALPN h2; SPF, DKIM and DMARC all configured; CAA records present. What to do If you downloaded or installed the package from onstrmapk.com, delete it, scan the device with maintained security software, and change any credentials entered on that page on the genuine service while enabling two-factor authentication. Defenders should block onstrmapk.com at proxy and DNS layers and track the associated script hashes. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a166c6-2dce-708a-bcc2-df94a71ee5a0/ Cloudflare Radar report: https://radar.cloudflare.com/scan/9364e390-3395-4fdc-81c3-67070017f970 URLQuery report: https://urlquery.net/report/8cf2c07f-4b63-443a-b241-2a109e1867a4 Stored capture screenshot: https://i.ibb.co/nqFKyQvh/c734130a6a22.png Cloudflare Radar screenshot (2026-10-23T02:17:48Z): https://screenshots.phishdestroy.io/cf/9364e390-3395-4fdc-81c3-67070017f970.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/8cf2c07f-4b63-443a-b241-2a109e1867a4.png URLScan screenshot (2026-10-18T17:53:35Z): https://screenshots.phishdestroy.io/us/01a15025-ad6b-710b-b545-f56dde480405.png URLScan capture report: https://urlscan.io/result/01a15025-ad6b-710b-b545-f56dde480405/ URLScan screenshot (2026-10-18T21:23:23Z): https://screenshots.phishdestroy.io/us/01a150e5-c089-72ec-9754-b9ea1e8ca199.png URLScan capture report: https://urlscan.io/result/01a150e5-c089-72ec-9754-b9ea1e8ca199/ URLScan screenshot (2026-10-22T15:32:07Z): https://screenshots.phishdestroy.io/us/01a1643d-6627-76af-8db6-581a17e5a47f.png URLScan capture report: https://urlscan.io/result/01a1643d-6627-76af-8db6-581a17e5a47f/ URLScan screenshot (2026-10-22T19:28:00Z): https://screenshots.phishdestroy.io/us/01a16515-69e9-718b-8090-281acef94677.png URLScan capture report: https://urlscan.io/result/01a16515-69e9-718b-8090-281acef94677/ URLScan screenshot (2026-10-23T02:12:51Z): https://screenshots.phishdestroy.io/us/01a16688-0197-719d-8366-f3eae2c1343a.png URLScan capture report: https://urlscan.io/result/01a16688-0197-719d-8366-f3eae2c1343a/ URLScan screenshot (2026-10-23T02:21:54Z): https://screenshots.phishdestroy.io/us/01a16682-bc7d-75de-9fab-5d11721e47bb.png URLScan capture report: https://urlscan.io/result/01a16682-bc7d-75de-9fab-5d11721e47bb/ VirusTotal report: https://www.virustotal.com/gui/domain/onstrmapk.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=onstrmapk.com Archived copy: https://web.archive.org/web/20261023014340/https://onstrmapk.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 22:37:44 UTC ## Stored page captures - Primary capture: https://i.ibb.co/nqFKyQvh/c734130a6a22.png Captured: 2026-10-23 03:21:14 UTC - URLScan capture 1: https://urlscan.io/screenshots/01a166c6-2dce-708a-bcc2-df94a71ee5a0.png Captured: 2026-10-23 03:21:14 UTC Source report: https://urlscan.io/result/01a166c6-2dce-708a-bcc2-df94a71ee5a0/ - URLScan capture 2: https://screenshots.phishdestroy.io/01a16634-eb2b-72cf-ad16-3c8d37d71c6e.png Captured: 2026-10-23 01:37:48 UTC Source report: https://urlscan.io/result/01a166c6-2dce-708a-bcc2-df94a71ee5a0/ - URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a15025-ad6b-710b-b545-f56dde480405.png Captured: 2026-10-18 17:53:35 UTC Source report: https://urlscan.io/result/01a15025-ad6b-710b-b545-f56dde480405/ SHA-256: e7d75541e1ad145794c45c49ed380ae3bc67435395f9999ac62d81364bbd0857 - URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a150e5-c089-72ec-9754-b9ea1e8ca199.png Captured: 2026-10-18 21:23:23 UTC Source report: https://urlscan.io/result/01a150e5-c089-72ec-9754-b9ea1e8ca199/ SHA-256: e7d75541e1ad145794c45c49ed380ae3bc67435395f9999ac62d81364bbd0857 - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a1643d-6627-76af-8db6-581a17e5a47f.png Captured: 2026-10-22 15:32:07 UTC Source report: https://urlscan.io/result/01a1643d-6627-76af-8db6-581a17e5a47f/ SHA-256: e7d75541e1ad145794c45c49ed380ae3bc67435395f9999ac62d81364bbd0857 - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a16515-69e9-718b-8090-281acef94677.png Captured: 2026-10-22 19:28:00 UTC Source report: https://urlscan.io/result/01a16515-69e9-718b-8090-281acef94677/ SHA-256: e7d75541e1ad145794c45c49ed380ae3bc67435395f9999ac62d81364bbd0857 - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16688-0197-719d-8366-f3eae2c1343a.png Captured: 2026-10-23 02:12:51 UTC Source report: https://urlscan.io/result/01a16688-0197-719d-8366-f3eae2c1343a/ SHA-256: e7d75541e1ad145794c45c49ed380ae3bc67435395f9999ac62d81364bbd0857 - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16682-bc7d-75de-9fab-5d11721e47bb.png Captured: 2026-10-23 02:21:54 UTC Source report: https://urlscan.io/result/01a16682-bc7d-75de-9fab-5d11721e47bb/ SHA-256: e7d75541e1ad145794c45c49ed380ae3bc67435395f9999ac62d81364bbd0857 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/9364e390-3395-4fdc-81c3-67070017f970.png Captured: 2026-10-23 02:17:48 UTC Source report: https://radar.cloudflare.com/scan/9364e390-3395-4fdc-81c3-67070017f970 SHA-256: fee92850057291591cb9bceaa9995321c508e5c26cd1ee7492c8a3ebc32ea969 - URLQuery: https://screenshots.phishdestroy.io/uq/8cf2c07f-4b63-443a-b241-2a109e1867a4.png Source report: https://urlquery.net/report/8cf2c07f-4b63-443a-b241-2a109e1867a4 SHA-256: 6b9d93ed10cec91ce2b86bdabd24a920d28d5d5f9f58783c6f8121053e04695a ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T03:26:22Z", "uuid": "01a166c6-2dce-708a-bcc2-df94a71ee5a0", "scanned_at": "2026-10-23T03:20:40Z", "final_url": "https://onstrmapk.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://onstrmapk.com/", "from": "http://onstrmapk.com/", "status": 307 } ], "ip": "156.67.222.102", "ips": [ "156.67.222.102" ], "asns": [ "47583" ], "countries": [ "SG" ], "link_domains": [ "www.facebook.com", "x.com", "www.pinterest.com", "f005.backblazeb2.com" ], "social": [ "https://www.facebook.com/profile.php", "https://x.com/onstrmapk" ], "doc_hash": "4a82b633123cb7a446a8603a4628c835e829e0477ac6dd2927a9c15834d08643", "script_hashes": [ "38bf4f385d34814ae8ed8884c704c3968a9c048c5b1234e7104765d7ca43de37", "726ac59577c8aeeec94c61bfb7791a709e401b5d871d35c39a65cd948f6124e3", "ff3d0e8b3eeb7ba127f9a3fa28f85a045e502f1b3740740c8464ee70d65588e1" ], "globals": [ "litespeed_docref", "lazyLoadOptions", "LazyLoad", "urlCreator", "litespeed_load_delayed_js_force", "litespeed_load_delayed_js", "litespeed_load_one", "litespeed_inline2src", "litespeed_ui_events", "litespeed_vary", "init", "touchstartListener", "touchstartEmptyListener", "mouseoverListener", "mousedownListener", "mouseoutListener", "mousedownShortcutListener", "isEventLikelyTriggeredByTouch", "isPreloadable", "preload", "preloadUsingSpeculationRules", "preloadUsingLinkElement", "_chromiumMajorVersionInUserAgent", "_speculationRulesType", "_allowQueryString", "_allowExternalLinks", "_useWhitelist", "_delayOnHover", "_lastTouchstartEvent", "_mouseoverTimer", "_preloadedList" ], "tls": { "san": [ "onstrmapk.com", "www.onstrmapk.com" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "onstrmapk.com", "protocol": "TLS 1.3", "valid_to": "2026-12-03T02:52:10Z", "valid_from": "2026-09-04T02:52:11Z" }, "domain_age_days": 48, "apex_age_days": 48, "tls_age_days": 49, "tls_valid_days": 89, "requests": 11, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.3.35", "content-security-policy": "upgrade-insecure-requests" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T02:23:49Z", "uuid": "9364e390-3395-4fdc-81c3-67070017f970", "scanned_at": "2026-10-23T02:17:48Z", "final_url": "https://onstrmapk.com/", "status": 200, "history": [ { "url": "https://onstrmapk.com/", "status": 200 }, { "url": "https://onstrmapk.com/", "status": 200 } ], "dom_hash": "120293e5820e2ff38af9510409ce693af2c8ec0e926ac01b8742aa0f45f8cb23", "doc_hash": "8346b07442e2d684db0d4f2370e4a652395e654711ec2d9457cafa587d47bf50", "domain_risks": [ "DGA Domains", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "onstrmapk.com", "type": "A", "value": "156.67.222.102" } ], "dnssec_valid": false, "ip": "156.67.222.102", "verdict": { "tags": [ "dga domains" ], "malicious": true, "categories": [ "dga domains" ] }, "whois": { "registrar": "OpusDNS GmbH", "created": "2026-09-04T03:48:02Z", "updated": "2026-09-11T18:18:59Z", "expires": "2027-09-04T03:48:02Z", "nameservers": [ "ns1.dns-parking.com", "ns2.dns-parking.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T02:16:46Z", "analysis_at": "2026-10-18T17:52:56Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 0, "suspicious": 0, "undetected": 38 }, "reputation": 0, "registrar": "OpusDNS GmbH", "created": "2026-09-04T03:48:02Z", "expires": "2027-09-04T03:48:02Z", "updated": "2026-09-11T18:18:59Z", "first_seen": "2026-09-04T04:48:55Z", "dns": [ { "ttl": 1800, "type": "A", "value": "156.67.222.102" }, { "ttl": 3600, "type": "TXT", "value": "v=spf1 include:_spf.mail.hostinger.com ~all" }, { "ttl": 21600, "type": "NS", "value": "ns2.dns-parking.com" }, { "ttl": 14400, "type": "MX", "value": "mx2.hostinger.com", "priority": 10 }, { "ttl": 21600, "type": "NS", "value": "ns1.dns-parking.com" }, { "ttl": 14400, "type": "MX", "value": "mx1.hostinger.com", "priority": 5 }, { "ttl": 3600, "type": "SOA", "rname": "dns.hostinger.com", "value": "ns1.dns-parking.com" } ], "dns_at": "2026-10-18T17:53:16Z", "jarm": "27d27d27d00027d00042d43d00041dba951fb796b4b956c9799ba19149e94a", "cert": { "san": [ "onstrmapk.com", "www.onstrmapk.com" ], "issuer": "Let's Encrypt / YE2", "serial": "6a5a45536a77f2748f43fc9b8b7bb48428", "sha256": "896b892e9d9f97785fab3aa5649599073510a4f2e015a07ddd04d1b78f3f5de5", "subject": "onstrmapk.com", "valid_to": "2026-12-03T02:52:10Z", "valid_from": "2026-09-04T02:52:11Z" }, "whois": { "registrar": "OpusDNS GmbH", "registrar_iana_id": "4340", "registrar_url": "http://www.opusdns.com", "created": "2026-09-04T03:48:02Z", "updated": "2026-09-11T18:18:59Z", "expires": "2027-09-04T03:48:02Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1.dns-parking.com", "ns2.dns-parking.com" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T02:24:08Z", "mail_config": { "mx": [ "mx2.hostinger.com", "mx1.hostinger.com" ], "spf": "v=spf1 include:_spf.mail.hostinger.com ~all", "dkim": [ "hostingermail-a" ], "dmarc": true, "dkim_bits": 2048, "spf_lookups": 3 }, "caa_records": { "domain": "onstrmapk.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-23T01:43:40Z", "first": "2026-10-02T00:10:00Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.05, "avg_page_bytes": 52658 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://onstrmapk.com/sitemap_index.xml", "https://onstrmapk.com/sitemap.xml", "https://onstrmapk.com/sitemap.html" ] }, "sitemap": { "present": true, "url_count": 7 }, "social_tags": { "ogUrl": "https://onstrmapk.com/", "title": "OnStream APK Download Latest Version 2026 – Movies & TV Shows", "ogType": "website", "robots": "follow, index, max-snippet:-1, max-video-preview:-1, max-image-preview:large", "ogImage": "https://onstrmapk.com/wp-content/uploads/2026/09/Blue-Modern-Online-Movie-Streaming-Facebook-Ad.webp", "ogTitle": "OnStream APK Download Latest Version 2026 – Movies & TV Shows", "generator": "WordPress 7.1.3", "ogSiteName": "onstreamAPK", "description": "Download Onstream APK app latest version for Android to explore movies, TV shows, web series and entertainment content. Get app info, features, updates, installation guides and device support.", "twitterCard": "summary_large_image", "canonicalUrl": "https://onstrmapk.com/", "ogDescription": "Download Onstream APK app latest version for Android to explore movies, TV shows, web series and entertainment content. Get app info, features, updates, installation guides and device support." }, "mixed_content": { "upgrade_insecure": true, "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 11, "tls": 166, "wait": 163, "connect": 162, "download": 905 }, "response_ms": 1407 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 80, 443, 3306 ] }, "carbon": { "bytes": 574090, "co2_grams": 0.021, "cleaner_than": 1 }, "dns_server": { "ns": [ { "ip": "162.159.24.201", "host": "ns1.dns-parking.com" }, { "ip": "162.159.25.42", "host": "ns2.dns-parking.com" } ], "zone": "onstrmapk.com" }, "location": { "ip": "156.67.222.102", "asn": "47583", "org": "HOSTINGER SG", "city": "Singapore", "country": "SG" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "onstrmapk.com" }, "dns": { "A": [ "156.67.222.102" ], "MX": [ "{\"exchange\": \"mx1.hostinger.com\", \"priority\": 5}", "{\"exchange\": \"mx2.hostinger.com\", \"priority\": 10}" ], "NS": [ "ns1.dns-parking.com", "ns2.dns-parking.com" ], "SOA": "{\"nsname\": \"ns1.dns-parking.com\", \"hostmaster\": \"dns.hostinger.com\", \"serial\": 2026102201, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 600}", "TXT": [ "v=spf1 include:_spf.mail.hostinger.com ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": "upgrade-insecure-requests", "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "156.67.222.102", "family": 4 }, "redirects": { "chain": [ "https://onstrmapk.com" ] }, "linked_pages": { "external": [ "https://www.facebook.com/profile.php", "https://x.com/onstrmapk", "https://www.pinterest.com/onstrmapk/", "https://f005.backblazeb2.com/file/liveonstrm/Onstream-Movies-TV-onstrmapk.com.xapk" ], "external_count": 4, "internal_count": 12 }, "whois": { "registrar": "OpusDNS GmbH", "created": "2026-09-04T03:48:02Z", "updated": "2026-09-11T18:18:59Z", "expires": "2027-09-04T03:48:02Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.dns-parking.com", "ns2.dns-parking.com" ] }, "headers": { "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.3.35", "content-security-policy": "upgrade-insecure-requests" } } } } ```