# PhishDestroy domain threat record: rojadirectahd.kim Content language: English Canonical HTML report: https://phishdestroy.io/domain/rojadirectahd.kim/ Machine-readable companion: https://phishdestroy.io/domain/rojadirectahd.kim/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 09:29:54 UTC - Last availability or vendor check: 2026-10-25 09:29:54 UTC - Stored record updated: 2026-10-25 10:07:25 UTC - VirusTotal detections in the stored snapshot: 2/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: santander ## Stored infrastructure - Observed IP address: 45.81.21.31 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-10-10 18:24:28 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17264-81d0-707b-bde3-e2793b100d7c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/rojadirectahd.kim - Certificate Transparency search: https://crt.sh/?q=%25.rojadirectahd.kim - Web Archive lookup: https://web.archive.org/web/*/https://rojadirectahd.kim/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed rojadirectahd.kim as a suspicious domain based on automated analysis. The recorded page title advertises live football streams, Pluto TV, and related services. The domain was first seen by PhishDestroy on 2026-10-25 and returned an HTTP 200 response on that date. How the scam works The listing does not confirm a particular fraud technique. Domains that mimic popular streaming services are often used to lure users into phishing, malicious downloads, or deceptive advertising, but no concrete behavior was observed on the captured page. Evidence VirusTotal reported two malicious detections (alphaMountain.ai and Fortinet) on 2026-10-24 analysis, retrieved on 2026-10-25. Google Safe Browsing showed no flag on 2026-10-25. urlscan.io’s engine marked the page as malicious with a score of 96 on 2026-10-25, while its overall verdict was clean. OTX listed three pulses mentioning the domain as of 2026-10-25. PhishDestroy’s internal blocklist includes the domain; external blocklists checked on 2026-10-25 returned zero matches. Infrastructure The domain was registered on 2026-10-10 through Dynadot Inc and was 13 days old at the time of observation. The recorded DNS A record pointed to 45.81.21.31, which was identified as belonging to IP Fiber Inc in the United States. The certificate observed was a Let’s Encrypt TLS certificate valid from 2026-10-21 to 2027-01-19. What to do Visitors should avoid entering credentials or personal data on the site and run a malware scan if they interacted with it. Security teams can block the exact domain in firewalls or proxy filters and monitor for any connections to 45.81.21.31. Continue to review updated intelligence for this domain. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a17264-81d0-707b-bde3-e2793b100d7c/ Cloudflare Radar report: https://radar.cloudflare.com/scan/fa40d64c-4ff4-4a46-b82e-728445a87f87 URLQuery report: https://urlquery.net/report/a4c10ded-bc3b-4c90-b4ff-050b916f64f8 Stored capture screenshot: https://i.ibb.co/nMCSrSg7/118c53826d59.png Cloudflare Radar screenshot (2026-10-25T10:01:47Z): https://screenshots.phishdestroy.io/cf/fa40d64c-4ff4-4a46-b82e-728445a87f87.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/a4c10ded-bc3b-4c90-b4ff-050b916f64f8.png URLScan screenshot (2026-10-21T16:51:57Z): https://screenshots.phishdestroy.io/us/01a15f60-3f19-74ca-8d9a-767ad8e10f90.png URLScan capture report: https://urlscan.io/result/01a15f60-3f19-74ca-8d9a-767ad8e10f90/ URLScan screenshot (2026-10-25T09:33:37Z): https://screenshots.phishdestroy.io/us/01a17268-58da-7359-bf9d-d12e9b162e3d.png URLScan capture report: https://urlscan.io/result/01a17268-58da-7359-bf9d-d12e9b162e3d/ VirusTotal report: https://www.virustotal.com/gui/domain/rojadirectahd.kim Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rojadirectahd.kim Archived copy: https://web.archive.org/web/20261025093013/https://rojadirectahd.kim/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 10:04:36 UTC ## Stored page captures - Primary capture: https://i.ibb.co/nMCSrSg7/118c53826d59.png Captured: 2026-10-25 09:29:54 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a17264-81d0-707b-bde3-e2793b100d7c.png Captured: 2026-10-25 09:29:54 UTC Source report: https://urlscan.io/result/01a17264-81d0-707b-bde3-e2793b100d7c/ - URLScan capture 2: https://urlscan.io/screenshots/01a15f60-3f19-74ca-8d9a-767ad8e10f90.png Captured: 2026-10-25 09:29:00 UTC Source report: https://urlscan.io/result/01a17264-81d0-707b-bde3-e2793b100d7c/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/fa40d64c-4ff4-4a46-b82e-728445a87f87.png Captured: 2026-10-25 10:01:47 UTC Source report: https://radar.cloudflare.com/scan/fa40d64c-4ff4-4a46-b82e-728445a87f87 SHA-256: 23dd3c2e77569fd175120fe4c191ac97c515dece4f62284654fb0afda61aad0a - URLQuery: https://screenshots.phishdestroy.io/uq/a4c10ded-bc3b-4c90-b4ff-050b916f64f8.png Source report: https://urlquery.net/report/a4c10ded-bc3b-4c90-b4ff-050b916f64f8 SHA-256: 8ad5d2eb6984a6f716a84422100f9f8451fb6af6e00321b2d4853d2923e4b00b - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15f60-3f19-74ca-8d9a-767ad8e10f90.png Captured: 2026-10-21 16:51:57 UTC Source report: https://urlscan.io/result/01a15f60-3f19-74ca-8d9a-767ad8e10f90/ SHA-256: 52e1deb054ed960b8975f797a961134d9337139a161878c4e91433364a86a784 - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17268-58da-7359-bf9d-d12e9b162e3d.png Captured: 2026-10-25 09:33:37 UTC Source report: https://urlscan.io/result/01a17268-58da-7359-bf9d-d12e9b162e3d/ SHA-256: 118f4b25c83d599d047089f40a0b54ce154d7f1430c411840f792c9115006211 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T10:04:03Z", "uuid": "01a17264-81d0-707b-bde3-e2793b100d7c", "scanned_at": "2026-10-25T09:29:20Z", "final_url": "https://rojadirectahd.kim/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://rojadirectahd.kim/", "from": "http://rojadirectahd.kim/", "status": 307 } ], "ip": "45.81.21.31", "ptr": "server1.server-sz.com", "domains": [ "platform-cdn.sharethis.com", "t.dtscout.com", "i.simpli.fi", "tags.crwdcntrl.net", "bcp.crwdcntrl.net", "um.simpli.fi", "px.mountain.com", "de.tynt.com", "pixel.onaudience.com", "t.dtscdn.com", "ic.tynt.com", "count-server.sharethis.com", "p.mrktmtrcs.net", "cdn.tynt.com", "pd.sharethis.com", "pxdrop.lijit.com", "luugy.com", "l.sharethis.com", "buttons-config.sharethis.com", "whos.amung.us", "my.rtmark.net", "llvpn.com", "waust.at", "platform-api.sharethis.com", "ajax.googleapis.com", "fonts.googleapis.com" ], "ips": [ "184.194.37.13", "136.116.231.182", "35.221.60.71", "34.49.192.216", "72.28.123.108", "37.187.82.52", "104.26.13.60", "108.138.128.46", "72.28.123.105", "13.33.67.81", "18.173.219.3", "172.67.70.156", "104.18.12.146", "3.13.98.145", "23.196.3.204" ], "asns": [ "14618", "396982", "36086", "16276", "13335", "16509", "20940", "9002", "15169", "204615" ], "countries": [ "US", "FR", "DE" ], "link_domains": [ "www.rojadirecta.kim" ], "doc_hash": "aac0846179b57d4d8578375dd0b2429edb9295673ca54b659b1d40e16567a220", "script_hashes": [ "c076e16f5798f33476b322383a9300e9cbbe1c58e00224465c47528a0cbd3e9b" ], "globals": [ "popUp", "popUpscroll", "mi_array", "globalhuso", "globalformato", "guardaHorario", "actualizaRadioFormato", "formatoRegion", "horaHuso", "toDate", "formatoAMPM", "formato24h", "fecha", "husodos", "husotres", "tS", "tN", "lZ", "tH", "dT", "aP", "oT", "table", "$", "jQuery", "_wau", "__ds3dcv__", "i1jaj1t6zz", "pvxjxgr1gtf", "zfgformats", "zfgstorage", "onClickTrigger", "syncCallbacks", "isSyncing", "zfgloadedpopup", "WAU_ren", "WAU_small", "WAU_small_request", "WAU_r_s", "WAU_insert" ], "cookies": [ "ID", "df", "l", "__cf_bm", "__dtsu", "uid", "pids", "suid", "_pubcid" ], "storage_keys": [ "__foo", "_waulasturl:91mohvrpdo", "__sharethis_local_storage_test__", "_wautime:91mohvrpdo", "_waucount:91mohvrpdo", "syncId", "syncOrigin", "syncDate", "syncFsa", "_dtspv", "mm", "_dtslplu", "st_shares_https://rojadirectahd.kim/", "__storage_test__", "_pubcid" ], "tls": { "san": [ "rojadirectahd.kim", "www.rojadirectahd.kim" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "www.rojadirectahd.kim", "protocol": "TLS 1.3", "valid_to": "2027-01-19T15:56:57Z", "valid_from": "2026-10-21T15:56:58Z" }, "domain_age_days": 13, "apex_age_days": 13, "tls_age_days": 3, "tls_valid_days": 89, "requests": 51, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 96, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T10:04:05Z", "uuid": "fa40d64c-4ff4-4a46-b82e-728445a87f87", "scanned_at": "2026-10-25T10:01:47Z", "final_url": "https://rojadirectahd.kim/", "status": 200, "history": [ { "url": "https://rojadirectahd.kim/", "status": 200 } ], "dom_hash": "a6725c47f5d418360c94676a30dd5ee4918dbd8019111268db753ef132c48658", "doc_hash": "aac0846179b57d4d8578375dd0b2429edb9295673ca54b659b1d40e16567a220", "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains", "Video Streaming", "Entertainment" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "rojadirectahd.kim", "type": "A", "value": "45.81.21.31" } ], "dnssec_valid": false, "ip": "45.81.21.31", "whois": { "registrar": "Dynadot Inc", "created": "2026-10-10T20:24:28Z", "updated": "2026-10-21T16:22:46Z", "expires": "2027-10-10T20:24:28Z", "nameservers": [ "jack.ns.cloudflare.com", "tiffany.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T10:01:10Z", "analysis_at": "2026-10-24T16:29:13Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 2, "suspicious": 0, "undetected": 36 }, "detections": { "Fortinet": "malware", "alphaMountain.ai": "malicious" }, "reputation": 0, "categories": { "alphaMountain.ai": "Malicious (alphaMountain.ai)" }, "first_seen": "2026-10-17T01:20:05Z", "dns": [ { "ttl": 300, "type": "SOA", "rname": "hostmaster.rojadirectahd.kim", "value": "ns1.dyna-ns.net" }, { "ttl": 300, "type": "NS", "value": "ns2.dyna-ns.net" }, { "ttl": 300, "type": "NS", "value": "ns1.dyna-ns.net" }, { "ttl": 300, "type": "A", "value": "45.81.21.31" } ], "dns_at": "2026-10-24T16:29:34Z", "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae", "cert": { "san": [ "rojadirectahd.kim", "www.rojadirectahd.kim" ], "issuer": "Let's Encrypt / YR2", "serial": "50986a6899da32c4b6334983146139bd713", "sha256": "e9568f86c98e148387a5f8341006eb8798e198ec660efb55b600d6c370048f1e", "subject": "www.rojadirectahd.kim", "valid_to": "2027-01-19T15:56:57Z", "valid_from": "2026-10-21T15:56:58Z" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-10-10T20:24:28Z", "last changed": "2026-10-23T20:29:54Z", "registration": "2026-10-10T20:24:28Z", "registrar expiration": "2027-10-10T20:24:28Z", "last update of RDAP database": "2026-10-23T20:38:01Z" }, "registrar": "DYNADOT LLC", "registrar_iana_id": "472" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T09:39:03Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "rojadirectahd.kim" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-25T09:30:13Z", "first": "2026-10-25T09:30:13Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 5194 }, "social_tags": { "title": "ROJADIRECTA – Fútbol En Vivo – Pluto Tv – Tarjeta Roja – PirloTV", "author": "ROJADIRECTA", "robots": "all", "keywords": "ROJADIRECTATV.TV, ROJADIRECTA.ME, ROJADIRECTA, ROJADIRECTAENVIVO.CLUB, TarjetarojaTv, tarjetarojaonline, rojadirectatv, rojadirecta, rojadirecta tv, en Vivo, ver en Vivo, link para ver, ver fútbol online, fútbol en vivo, universitario, palmeiras, cerro porteño, liga mx, Club America, Chivas de guada", "description": "ROJADIRECTA Tarjeta Roja TV Fútbol En Vivo PirloTV Laliga Liga Mx Champions League Roja directa indexa los canales y streamg los partidos de Fútbol en Vivo", "canonicalUrl": "https://rojadirecta.kim" }, "trackers": { "requests": 32, "trackers": [ { "name": "Advertising Technologies Ltd", "company": "Big Wall Vision", "category": "Advertising", "requests": 2 }, { "name": "DTScout", "company": "DTscout", "category": "Advertising", "requests": 2 }, { "name": "ShareThis", "company": "ShareThis, Inc.", "country": "US", "category": "Advertising", "requests": 14 }, { "name": "Google APIs", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Whos.amung.us", "company": "whos.amung.us", "country": "CA", "category": "Site Analytics", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://platform-api.sharethis.com/js/sharethis.js", "https://waust.at/s.js", "https://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js" ], "active_insecure": [ "http://fonts.googleapis.com/css" ], "third_party_scripts": 3 }, "status": { "up": true, "code": 200, "timings": { "dns": 621, "tls": 22, "wait": 17, "connect": 13, "download": 12 }, "response_ms": 685 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 25, 53, 80, 110, 143, 443, 587, 993, 995 ] }, "carbon": { "bytes": 21423, "co2_grams": 0.0008, "cleaner_than": 55 }, "dns_server": { "ns": [ { "ip": "162.159.27.158", "host": "ns1.dyna-ns.net" }, { "ip": "162.159.24.5", "host": "ns2.dyna-ns.net" } ], "zone": "rojadirectahd.kim" }, "cookies": { "cookies": [ { "name": "df", "secure": true, "same_site": "None" } ] }, "location": { "ip": "45.81.21.31", "asn": "204615", "org": "IP Fiber Inc", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YR2", "subject": "www.rojadirectahd.kim" }, "dns": { "A": [ "45.81.21.31" ], "NS": [ "ns2.dyna-ns.net", "ns1.dyna-ns.net" ], "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.rojadirectahd.kim\", \"serial\": 2026102301, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "45.81.21.31", "family": 4 }, "redirects": { "chain": [ "https://rojadirectahd.kim" ] }, "linked_pages": { "external": [ "https://www.rojadirecta.kim/" ], "external_count": 1, "internal_count": 31 }, "headers": { "headers": { "content-type": "text/html; charset=UTF-8" } } } } ```