# PhishDestroy domain threat record: rojadirectaoficial.de Content language: English Canonical HTML report: https://phishdestroy.io/domain/rojadirectaoficial.de/ Machine-readable companion: https://phishdestroy.io/domain/rojadirectaoficial.de/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 09:35:40 UTC - Last availability or vendor check: 2026-10-25 11:00:26 UTC - Stored record updated: 2026-10-25 11:10:32 UTC - VirusTotal detections in the stored snapshot: 2/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 45.81.21.31 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-06-21 07:01:52 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a08ac3-dd75-70e4-812c-320296a36bc0/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/rojadirectaoficial.de - Certificate Transparency search: https://crt.sh/?q=%25.rojadirectaoficial.de - Web Archive lookup: https://web.archive.org/web/*/https://rojadirectaoficial.de/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed rojadirectaoficial.de as a suspicious domain based on a client‑side redirect to rojadirectastream.online. The recorded page title advertises live football streaming under the name ROJADIRECTA TV. The domain was first seen by PhishDestroy on 2026-10-25 and returned HTTP 200 at that time. How the scam works The assessment flags the site because it redirects visitors to another domain, a technique commonly used in phishing, ad‑fraud or malware distribution campaigns. No credential‑stealing form, wallet request, or malicious payload was observed on the page, so the exact intent cannot be confirmed. Evidence VirusTotal recorded two malicious detections from alphaMountain.ai and Fortinet out of 92 engines on 2026-10-25 (analysis date 2026-10-15). Google Safe Browsing checked on 2026-10-25 and reported no threat. urlscan captured the page on 2026-09-10; its overall verdict was clean but its engine score labeled the URL malicious with a 79‑point confidence. OTX listed two pulses referencing the domain as of 2026-10-25, and PhishDestroy’s internal blocklist marks it as blocked while external blocklists returned zero hits on that date. Infrastructure The domain was registered on 2026-06-21 through Dynadot Inc and was nine days old at the time of the first capture. It resolved to the recorded IP 45.81.21.31, which was associated with IP Fiber Inc in the Netherlands and was served behind Cloudflare. The TLS certificate, issued by Let’s Encrypt, covered *.rojadirectaoficial.de and was valid until 2026-12-09; DNSSEC records were not observed. What to do Visitors should avoid entering any credentials or personal information on the site and clear browser cookies and storage if they have interacted with it. Security teams should block the exact domain in network filters, monitor DNS logs for queries to rojadirectaoficial.de, and review access logs for redirection activity. Users who suspect account compromise should change passwords on affected services. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a08ac3-dd75-70e4-812c-320296a36bc0/ Cloudflare Radar report: https://radar.cloudflare.com/scan/58f51453-edec-4a65-9a03-6723bde03a30 Stored capture screenshot: https://urlscan.io/screenshots/01a08ac3-dd75-70e4-812c-320296a36bc0.png Cloudflare Radar screenshot (2026-10-25T09:38:27Z): https://screenshots.phishdestroy.io/cf/58f51453-edec-4a65-9a03-6723bde03a30.png URLScan screenshot (2026-10-25T09:36:12Z): https://screenshots.phishdestroy.io/us/01a1726a-d356-701b-89a8-143e5277f0ef.png URLScan capture report: https://urlscan.io/result/01a1726a-d356-701b-89a8-143e5277f0ef/ VirusTotal report: https://www.virustotal.com/gui/domain/rojadirectaoficial.de Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rojadirectaoficial.de Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 10:12:42 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a08ac3-dd75-70e4-812c-320296a36bc0.png Captured: 2026-10-25 09:35:40 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a08ac3-dd75-70e4-812c-320296a36bc0.png Source report: https://urlscan.io/result/01a08ac3-dd75-70e4-812c-320296a36bc0/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/58f51453-edec-4a65-9a03-6723bde03a30.png Captured: 2026-10-25 09:38:27 UTC Source report: https://radar.cloudflare.com/scan/58f51453-edec-4a65-9a03-6723bde03a30 SHA-256: c41b8ddaaa983bcf246426fc1d845f5602cb6ba97c2acc88a679d43e7091d16a - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a1726a-d356-701b-89a8-143e5277f0ef.png Captured: 2026-10-25 09:36:12 UTC Source report: https://urlscan.io/result/01a1726a-d356-701b-89a8-143e5277f0ef/ SHA-256: 2cebaf08035cda92333a584df8258cc10789d1216f2d250df1709e69d100e0b7 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T09:40:47Z", "uuid": "01a08ac3-dd75-70e4-812c-320296a36bc0", "scanned_at": "2026-09-10T10:01:45Z", "final_url": "https://rojadirectaoficial.de/", "status": 200, "ip": "172.67.153.214", "domains": [ "platform-cdn.sharethis.com", "sync.sharethis.com", "t.sharethis.com", "sync.srv.stackadapt.com", "ml314.com", "ps.eyeota.net", "t.dtscout.com", "l.sharethis.com", "us-u.openx.net", "d.turn.com", "pixel-sync.sitescout.com", "dpm.demdex.net", "map.go.affec.tv", "aorta.clickagy.com", "pixel.onaudience.com", "aa.agkn.com", "ws.rqtrk.eu", "ce.lijit.com", "idsync.rlcdn.com", "bcp.crwdcntrl.net", "count-server.sharethis.com", "luugy.com", "p.mrktmtrcs.net", "my.rtmark.net", "whos.amung.us", "buttons-config.sharethis.com", "llvpn.com", "static.cloudflareinsights.com", "waust.at", "platform-api.sharethis.com" ], "ips": [ "34.98.64.218", "2001:678:cb4:bbbb::30", "34.36.216.150", "52.215.160.228", "108.133.205.42", "13.219.143.65", "148.113.153.94", "34.227.131.124", "57.129.18.113", "54.77.34.52", "35.244.174.68", "107.23.152.5", "34.117.77.79", "3.125.91.237", "3.68.22.167" ], "asns": [ "16509", "14618", "16276", "396982", "9002", "13335", "20940", "15169" ], "countries": [ "IE", "US", "CA", "DE" ], "doc_hash": "801c04f0c21de575022190af0e910c055638fa07e3e76a93357d404c7fd52899", "script_hashes": [ "1103ba5a77abaffd3bd0500175b45146c381e1b7c6b9315de88b3f58c397d06c", "2cb02951c16e6c7d70b4cb027ea5071f8fe07785173712147d788082959a66b2", "c076e16f5798f33476b322383a9300e9cbbe1c58e00224465c47528a0cbd3e9b" ], "globals": [ "__API_URL__", "popUp", "popUpscroll", "mi_array", "globalhuso", "globalformato", "guardaHorario", "actualizaRadioFormato", "formatoRegion", "horaHuso", "toDate", "formatoAMPM", "formato24h", "fecha", "husodos", "husotres", "tS", "tN", "lZ", "tH", "dT", "aP", "oT", "table", "_wau", "st", "__stdos__", "tpcCookiesEnableCheckingDone", "tpcCookiesEnabledStatus", "__sharethis__docReady", "__sharethis__", "ua_fields", "WAU_ren", "WAU_small", "WAU_small_request", "WAU_r_s", "WAU_insert", "WAU_legacy_b", "WAU_la", "WAU_addCommas" ], "cookies": [ "ID", "__stid", "__stidv", "fpestid", "df", "SERVERID", "sa-user-id", "sa-user-id-v2", "sa-user-id-v4", "pxcelPage_default_c010_B", "pt" ], "storage_keys": [ "__sharethis_local_storage_test__", "_waulasturl:ny6czev00o", "__foo", "syncId", "syncOrigin", "syncDate", "_wautime:ny6czev00o", "_waucount:ny6czev00o", "_dtspv", "mm", "st_shares_https://rojadirectaoficial.de/" ], "tls": { "san": [ "*.rojadirectaoficial.de", "rojadirectaoficial.de" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "rojadirectaoficial.de", "protocol": "QUIC", "valid_to": "2026-12-09T02:35:23Z", "valid_from": "2026-09-10T02:35:24Z" }, "domain_age_days": 9, "apex_age_days": 9, "tls_age_days": 0, "tls_valid_days": 89, "requests": 53, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 79, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T09:40:50Z", "uuid": "58f51453-edec-4a65-9a03-6723bde03a30", "scanned_at": "2026-10-25T09:38:27Z", "final_url": "https://rojadirectastream.online/", "status": 403, "history": [ { "url": "https://rojadirectaoficial.de/", "status": 200 }, { "url": "https://rojadirectastream.online/", "status": 403 } ], "dom_hash": "e1e0ec04ba2dccd9143717ccf431a0c9d267fac4083951806a2652b5fb5fcf8d", "doc_hash": "8e766fa0f257f4018a6247d11a1567f75afadd7156f521f24cce1feb7abcbf2f", "domain_risks": [ "Video Streaming", "Entertainment" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "rojadirectastream.online", "type": "A", "value": "104.21.17.51" }, { "name": "rojadirectastream.online", "type": "A", "value": "172.67.222.81" }, { "name": "rojadirectastream.online", "type": "AAAA", "value": "2606:4700:3032::6815:1133" }, { "name": "rojadirectastream.online", "type": "AAAA", "value": "2606:4700:3034::ac43:de51" } ], "dnssec_valid": false, "ip": "104.21.17.51", "whois": { "registrar": "Dynadot Inc", "created": "2026-06-21T09:01:52Z", "updated": "2026-09-16T22:30:07Z", "expires": "2027-06-21T09:01:52Z", "nameservers": [ "kami.ns.cloudflare.com", "milan.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T10:10:37Z", "analysis_at": "2026-10-15T20:44:50Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 2, "suspicious": 0, "undetected": 37 }, "detections": { "Fortinet": "malware", "alphaMountain.ai": "malicious" }, "reputation": 0, "categories": { "alphaMountain.ai": "Malicious (alphaMountain.ai)" }, "popularity": { "Cisco Umbrella": 970305 }, "first_seen": "2026-09-01T00:57:41Z", "dns": [ { "ttl": 300, "type": "NS", "value": "ns1.dyna-ns.net" }, { "ttl": 300, "type": "A", "value": "45.81.21.31" }, { "ttl": 300, "type": "NS", "value": "ns2.dyna-ns.net" }, { "ttl": 300, "type": "SOA", "rname": "hostmaster.rojadirectaoficial.de", "value": "ns1.dyna-ns.net" } ], "dns_at": "2026-10-15T21:46:39Z", "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae", "cert": { "san": [ "rojadirectaoficial.de", "www.rojadirectaoficial.de" ], "issuer": "Let's Encrypt / YR2", "serial": "5b27b93a710fe929aab2f22cdd84344aa4f", "sha256": "43ef59a7a08cba4313fd61a547d2ab18d2f4af2bf9cfb32ac53b4a533a2304c3", "subject": "www.rojadirectaoficial.de", "valid_to": "2026-12-09T02:36:35Z", "valid_from": "2026-09-10T02:36:36Z" }, "rdap": { "status": [ "active" ], "events": { "last changed": "2026-09-12T18:49:36Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T09:38:32Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "rojadirectaoficial.de" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-25T09:35:53Z", "first": "2026-10-25T09:35:53Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 5176 }, "social_tags": { "ogUrl": "https://rojadirectaoficial.de", "title": "ROJADIRECTA TV – Fútbol en Vivo – PirloTv – Pluto Tv", "ogType": "website", "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1", "ogTitle": "ROJADIRECTA TV - Fútbol en Vivo", "keywords": "ROJADIRECTA TV, ROJADIRECTATV, futbol en vivo, ver fútbol online, liga mx en vivo, mls en vivo, serie a en vivo, pirlo tv, rojadirecta, futbol gratis, Roja Directa TV EN VIVO, Roja Tv, Roja Directa TV Live, RojaDirecta TV Live, Tarjeta Roja", "ogSiteName": "ROJADIRECTA TV", "themeColor": "#e30909", "description": "RojaDirectaTv, PirloTv, Tarjetaroja Tv, Pluto Tv, Fútbol en Vivo es la web para ver fútbol en vivo, Mira los mejores partidos de fútbol en vivo: Liga MX, MLS, Serie A, Champions League y más deportes en directo. Programación deportiva gratis.", "twitterCard": "summary", "canonicalUrl": "https://rojadirectaoficial.de", "ogDescription": "Mira los mejores partidos de fútbol en vivo gratis. Liga MX, MLS, Serie A y más deportes en directo." }, "mixed_content": { "no_sri": [ "https://platform-api.sharethis.com/js/sharethis.js", "https://waust.at/s.js" ], "third_party_scripts": 2 }, "status": { "up": true, "code": 200, "timings": { "dns": 2021, "tls": 20, "wait": 35, "connect": 12, "download": 1 }, "response_ms": 2089 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "carbon": { "bytes": 25454, "co2_grams": 0.0009, "cleaner_than": 52 }, "dns_server": { "ns": [ { "ip": "162.159.26.92", "host": "ns1.dyna-ns.net" }, { "ip": "162.159.24.5", "host": "ns2.dyna-ns.net" } ], "zone": "rojadirectaoficial.de" }, "cookies": { "cookies": [ { "name": "__cf_bm", "secure": true, "http_only": true, "same_site": "None" } ] }, "location": { "ip": "45.81.21.31", "asn": "204615", "org": "IP Fiber Inc", "city": "Amsterdam", "country": "NL" }, "ssl": { "issuer": "Let's Encrypt / YR2", "subject": "www.rojadirectaoficial.de" }, "dns": { "A": [ "45.81.21.31" ], "NS": [ "ns1.dyna-ns.net", "ns2.dyna-ns.net" ], "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.rojadirectaoficial.de\", \"serial\": 2026091201, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "45.81.21.31", "family": 4 }, "redirects": { "chain": [ "https://rojadirectaoficial.de" ] }, "linked_pages": { "internal_count": 56 }, "whois": { "updated": "2026-09-12T18:49:36Z", "status": [ "connect" ], "nameservers": [ "ns1.dyna-ns.net", "ns2.dyna-ns.net" ] }, "headers": { "headers": { "content-type": "text/html; charset=UTF-8" } } } } ```