# PhishDestroy threat dossier — pregnabalance.com ================================================================ Fetched: 2026-07-28 13:29:29 UTC Canonical: https://phishdestroy.io/domain/pregnabalance.com/ ## VERDICT ---------------------------------------------------------------- ACTIVE THREAT — multiple warning signs Composite threat score: 57/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Fortinet AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 192.142.10.5 (NL, Amsterdam) ASN: AS214036 Ultahost, Inc. Hosting org: Ultahost Inc Registrar: DreamHost, LLC Nameservers: ["ns1.ultahost.com", "ns2.ultahost.com", "ns3.ultahost.com", "ns4.ultahost.com"] Page title: Natural Pregnancy Wellness Guide 2025 | Pregna Balance - Feel Your Best Every Trimester HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-09-30 Status: INVALID chain Fingerprint: 08240f8e42c65d1cb728ea7322669ea9fd732926488623f746012f7c0ce22f33 Subject Alternative Names (related infrastructure — often same operator): - autoconfig.breastadvantage.com - autoconfig.pregnabalance.com - autodiscover.breastadvantage.com - autodiscover.pregnabalance.com - breastadvantage.com - breastadvantage.com.redbagproductions.com - cpanel.breastadvantage.com - cpanel.pregnabalance.com - cpcalendars.breastadvantage.com - cpcalendars.pregnabalance.com - cpcontacts.breastadvantage.com - cpcontacts.pregnabalance.com - mail.breastadvantage.com - mail.pregnabalance.com - pregnabalance.com.redbagproductions.com ... +8 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-27 22:33:09 UTC (by PhishDestroy tracker) Last verified: 2026-07-28 12:55:33 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-27 22:34:48 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] pregnabalance.com — Generic Phishing Threat Report Pregnabalance.com is currently resolved to an HTTP 200 response, indicating that a web server is actively serving content. The domain is registered through DreamHost, LLC and delegated to four nameservers operated by ultahost.com (ns1‑ns4.ultahost.com). The registrar and nameserver configuration are typical for many hosting services and do not, by themselves, provide malicious indication, but they confirm that the domain is live and controllable by the attacker. Threat intelligence indicates that the site is classified as a generic phishing vector. Independent analysis by 2 of 91 security vendors on VirusTotal has raised a detection flag, demonstrating that at least two reputable scanners have identified malicious characteristics. The domain is also listed on a security blocklist and has been actively blocked by the PhishDestroy mitigation service, confirming that downstream defenses are already treating it as hostile. The domain remains marked as active as of the report date (July 27 2026) and appears on one public blocklist, suggesting limited but observable abuse. No public Safe Browsing, OTX, SSL certificate, or page‑title information has been disclosed, and the underlying IP address or hosting location has not been released, leaving those aspects of the infrastructure unverified. Consequently, defenders cannot yet correlate the site with specific credential‑stealing kits or target brands. Based on the available evidence, security teams should block preg​nabalance.com at network perimeter and DNS resolution layers, add it to local threat intelligence feeds, and monitor any outbound connections to the domain’s IP range once identified. Continuous re‑scanning with multi‑engine services is recommended to capture any evolution of the payload. Organizations should also advise users to remain vigilant for unsolicited communications that may reference the domain, even though the exact phishing lure has not been publicly documented. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 629e8975c35678a4414774fc98d4604d TLS cert SHA-256: 08240f8e42c65d1cb728ea7322669ea9fd732926488623f746012f7c0ce22f33 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/pregnabalance.com/ JSON API: https://api.destroy.tools/v1/check?domain=pregnabalance.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 210,953 domains (85,393 alive under monitoring, 124,530 confirmed takedowns/dead). Site: https://phishdestroy.io