# PhishDestroy domain threat record: rojatvdirecta.dev Content language: English Canonical HTML report: https://phishdestroy.io/domain/rojatvdirecta.dev/ Machine-readable companion: https://phishdestroy.io/domain/rojatvdirecta.dev/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 09:31:11 UTC - Last availability or vendor check: 2026-10-25 09:31:11 UTC - Stored record updated: 2026-10-25 11:31:00 UTC - VirusTotal detections in the stored snapshot: 3/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: santander ## Stored infrastructure - Observed IP address: 45.81.21.31 - Registrar in stored WHOIS data: Dynadot LLC. - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-09-19 13:23:13 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17264-812e-7313-9bed-9cf92d2317a4/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/rojatvdirecta.dev - Certificate Transparency search: https://crt.sh/?q=%25.rojatvdirecta.dev - Web Archive lookup: https://web.archive.org/web/*/https://rojatvdirecta.dev/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added rojatvdirecta.dev to its blocklist on 2026-10-25 after an intake noted three malicious detections on VirusTotal. The recorded page title advertises live football streams and related video services. An HTTP 200 response was observed on the same date, and the site redirected through several off‑site domains before reaching a final streaming page. How the scam works The observed pattern of a short‑lived domain that redirects users across multiple unrelated sites is a common technique used to generate ad revenue, deliver unwanted software, or funnel visitors to phishing pages. While no credential‑stealing or wallet‑draining behavior was directly observed on this page, such redirect chains can expose users to downstream malicious content. Evidence VirusTotal scanned the domain on 2026-10-23 and, as retrieved on 2026-10-25, reported three malicious detections out of 92 engines (alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet). Google Safe Browsing checked on 2026-10-25 and reported no warning. OTX listed four pulses referencing the domain as of 2026-10-25. PhishDestroy’s internal blocklist marked the domain as blocked on 2026-10-25. URLScan captured the redirect chain on 2026-10-25; its engine score labeled the final URL as malicious with a score of 76, while the overall verdict was non‑malicious. Infrastructure The domain was registered on 2026-09-19 through Dynadot LLC and used the nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. The recorded IP address was 45.81.21.31, which the scan identified as belonging to IP Fiber Inc in the United States. A Let’s Encrypt TLS certificate covering the domain and its www subdomain was issued on 2026-09-19 and was valid until 2026-12-18. What to do Avoid visiting or interacting with rojatvdirecta.dev and do not submit any credentials or download files from it. If login information was entered, change the associated passwords immediately. Network defenders should block the domain, monitor for outbound connections to the observed redirect chain, and log any access attempts for further investigation. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a17264-812e-7313-9bed-9cf92d2317a4/ Cloudflare Radar report: https://radar.cloudflare.com/scan/140be79c-7bce-40b0-8251-97e0efe29d16 URLQuery report: https://urlquery.net/report/573b2e81-477c-4dfd-aaff-efb852ee8c24 Stored capture screenshot: https://i.ibb.co/Y77hnJdy/e53688998456.png Cloudflare Radar screenshot (2026-10-25T10:06:19Z): https://screenshots.phishdestroy.io/cf/140be79c-7bce-40b0-8251-97e0efe29d16.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/573b2e81-477c-4dfd-aaff-efb852ee8c24.png URLScan screenshot (2026-10-25T09:33:54Z): https://screenshots.phishdestroy.io/us/01a17268-8f78-74dd-855e-b35d4865ffe0.png URLScan capture report: https://urlscan.io/result/01a17268-8f78-74dd-855e-b35d4865ffe0/ VirusTotal report: https://www.virustotal.com/gui/domain/rojatvdirecta.dev Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rojatvdirecta.dev Archived copy: https://web.archive.org/web/20261025093235/https://rojatvdirecta.dev/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 11:08:40 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Y77hnJdy/e53688998456.png Captured: 2026-10-25 09:31:11 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a17264-812e-7313-9bed-9cf92d2317a4.png Captured: 2026-10-25 09:31:11 UTC Source report: https://urlscan.io/result/01a17264-812e-7313-9bed-9cf92d2317a4/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/140be79c-7bce-40b0-8251-97e0efe29d16.png Captured: 2026-10-25 10:06:19 UTC Source report: https://radar.cloudflare.com/scan/140be79c-7bce-40b0-8251-97e0efe29d16 SHA-256: 481e81e7ecce16ce48b96eb11d4244069dd30b08d4133954a67c4eb6707a9220 - URLQuery: https://screenshots.phishdestroy.io/uq/573b2e81-477c-4dfd-aaff-efb852ee8c24.png Source report: https://urlquery.net/report/573b2e81-477c-4dfd-aaff-efb852ee8c24 SHA-256: 8ad5d2eb6984a6f716a84422100f9f8451fb6af6e00321b2d4853d2923e4b00b - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17268-8f78-74dd-855e-b35d4865ffe0.png Captured: 2026-10-25 09:33:54 UTC Source report: https://urlscan.io/result/01a17268-8f78-74dd-855e-b35d4865ffe0/ SHA-256: ddc9090603b0e11aca54d0e846f76c79d439808c23840e0a43c12ed42d4beace ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T10:08:27Z", "uuid": "01a17264-812e-7313-9bed-9cf92d2317a4", "scanned_at": "2026-10-25T09:30:59Z", "final_url": "https://rojadirecta.city/", "status": 200, "redirected": "off-domain", "redirects": [ { "to": "https://rojatvdirecta.dev/", "from": "http://rojatvdirecta.dev/", "status": 307 }, { "to": "https://rojadirectaoficial.blog/", "from": "https://rojatvdirecta.dev/" }, { "to": "https://rojadirectaoficial.tax/", "from": "https://rojadirectaoficial.blog/" }, { "to": "https://rojadirectaoficial.lol/", "from": "https://rojadirectaoficial.tax/" }, { "to": "https://rojadirectahd.world/", "from": "https://rojadirectaoficial.lol/" }, { "to": "https://rojadirecta.city/", "from": "https://rojadirectahd.world/" } ], "ip": "45.81.21.31", "ptr": "server1.server-sz.com", "domains": [ "platform-cdn.sharethis.com", "waust.at", "platform-api.sharethis.com", "fonts.googleapis.com", "rojatvdirecta.dev", "tags.crwdcntrl.net", "t.dtscout.com", "l.sharethis.com", "rojadirectahd.world", "static.cloudflareinsights.com", "bcp.crwdcntrl.net", "pd.sharethis.com", "t.sharethis.com", "llvpn.com", "ajax.googleapis.com", "secure.adnxs.com", "dp1.33across.com", "idsync.rlcdn.com", "dp2.33across.com", "de.tynt.com", "ic.tynt.com", "pixel.onaudience.com", "t.dtscdn.com", "luugy.com", "p.mrktmtrcs.net", "cdn.tynt.com", "pxdrop.lijit.com", "count-server.sharethis.com", "whos.amung.us", "buttons-config.sharethis.com" ], "ips": [ "184.194.37.13", "3.209.44.196", "68.67.181.211", "72.28.123.110", "35.244.154.8", "72.28.123.107", "72.28.123.108", "72.28.123.105", "51.38.30.15", "104.26.13.60", "108.138.128.34", "139.45.197.106", "104.26.15.100", "104.18.12.146", "3.150.151.38" ], "asns": [ "14618", "29990", "36086", "396982", "16276", "13335", "16509", "9002", "20940", "15169" ], "countries": [ "US", "FR", "DE" ], "link_domains": [ "www.rojadirecta.kim" ], "doc_hash": "19f6ad9a20523bef1201aaf0b029b8295613439df87a9446a94a1115533a84be", "script_hashes": [ "c076e16f5798f33476b322383a9300e9cbbe1c58e00224465c47528a0cbd3e9b" ], "globals": [ "popUp", "popUpscroll", "mi_array", "globalhuso", "globalformato", "guardaHorario", "actualizaRadioFormato", "formatoRegion", "horaHuso", "toDate", "formatoAMPM", "formato24h", "fecha", "husodos", "husotres", "tS", "tN", "lZ", "tH", "dT", "aP", "oT", "table", "$", "jQuery", "_wau", "st", "__stdos__", "tpcCookiesEnableCheckingDone", "tpcCookiesEnabledStatus", "__sharethis__docReady", "__sharethis__", "ua_fields", "WAU_ren", "WAU_small", "WAU_small_request", "WAU_r_s", "WAU_insert", "WAU_legacy_b", "WAU_la" ], "cookies": [ "df", "l", "ID", "fpestid", "__cf_bm", "__dtsu", "uid", "pids", "TapAd_TS", "TapAd_DID", "33x_ps", "rlas3", "pxrc", "TDID", "TDCPM", "TapAd_3WAY_SYNCS", "_pubcid", "_cc_dc", "_cc_id", "_cc_cc" ], "storage_keys": [ "__sharethis_local_storage_test__", "_waulasturl:e7vwu95jf9", "__foo", "_wautime:e7vwu95jf9", "_waucount:e7vwu95jf9", "syncId", "syncOrigin", "syncDate", "syncFsa", "_dtspv", "st_shares_https://rojadirecta.city/", "_dtslplu", "mm", "__storage_test__", "_pubcid" ], "tls": { "san": [ "rojatvdirecta.dev", "www.rojatvdirecta.dev" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "rojatvdirecta.dev", "protocol": "TLS 1.3", "valid_to": "2026-12-18T14:40:27Z", "valid_from": "2026-09-19T14:40:28Z" }, "domain_age_days": 1036, "apex_age_days": 1036, "tls_age_days": 4, "tls_valid_days": 89, "requests": 97, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 76, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T10:08:30Z", "uuid": "140be79c-7bce-40b0-8251-97e0efe29d16", "scanned_at": "2026-10-25T10:06:19Z", "final_url": "https://rojadirecta.city/", "status": 200, "history": [ { "url": "https://rojatvdirecta.dev/", "status": 200 }, { "url": "https://rojadirectaoficial.blog/", "status": 200 }, { "url": "https://rojadirectaoficial.tax/", "status": 200 }, { "url": "https://rojadirectaoficial.lol/", "status": 200 }, { "url": "https://rojadirectahd.world/", "status": 200 }, { "url": "https://rojadirecta.city/", "status": 200 } ], "dom_hash": "6de8b2eaa5997f7c0b308e5eeebd90a9990a9eb654942039f184398496a84c41", "doc_hash": "19f6ad9a20523bef1201aaf0b029b8295613439df87a9446a94a1115533a84be", "domain_risks": [ "Video Streaming", "Entertainment" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "rojadirecta.city", "type": "A", "value": "45.81.21.31" } ], "dnssec_valid": false, "ip": "45.81.21.31", "whois": { "registrar": "Dynadot Inc", "created": "2026-10-18T21:30:02Z", "updated": "2026-10-23T21:30:58Z", "expires": "2027-10-18T21:30:02Z", "nameservers": [ "ns1.dyna-ns.net", "ns2.dyna-ns.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T11:07:42Z", "analysis_at": "2026-10-22T22:53:43Z", "stats": { "timeout": 0, "harmless": 52, "malicious": 3, "suspicious": 0, "undetected": 37 }, "detections": { "Fortinet": "malware", "alphaMountain.ai": "malicious", "Forcepoint ThreatSeeker": "malicious" }, "reputation": 0, "categories": { "alphaMountain.ai": "Malicious, Newly Registered (alphaMountain.ai)" }, "first_seen": "2026-09-19T15:59:29Z", "dns": [ { "ttl": 300, "type": "NS", "value": "ns1.dyna-ns.net" }, { "ttl": 300, "type": "A", "value": "45.81.21.31" }, { "ttl": 300, "type": "NS", "value": "ns2.dyna-ns.net" }, { "ttl": 300, "type": "SOA", "rname": "hostmaster.rojatvdirecta.dev", "value": "ns1.dyna-ns.net" } ], "dns_at": "2026-10-22T22:57:20Z", "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae", "cert": { "san": [ "rojatvdirecta.dev", "www.rojatvdirecta.dev" ], "issuer": "Let's Encrypt / YR2", "serial": "5b0f68ede5d9a358f9ab68df8fbb3897bab", "sha256": "1ce105638c03540da500eaa61d7954761d1686334e128559604c3ab9ed4303c0", "subject": "rojatvdirecta.dev", "valid_to": "2026-12-18T14:40:27Z", "valid_from": "2026-09-19T14:40:28Z" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-09-19T15:23:13Z", "last changed": "2026-10-03T14:39:22Z", "registration": "2026-09-19T15:23:13Z", "registrar expiration": "2027-09-19T15:23:13Z", "last update of RDAP database": "2026-10-22T08:58:20Z" }, "registrar": "DYNADOT LLC", "registrar_iana_id": "472" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T09:39:05Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "rojatvdirecta.dev" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-25T09:32:35Z", "first": "2026-09-19T20:10:57Z", "changes": 1, "days_archived": 3, "scans_per_day": 0.06, "avg_page_bytes": 3060 }, "social_tags": { "ogUrl": "https://www.rojadirectastream.blog", "title": "ROJADIRECTA TV – Fútbol en Vivo – PirloTv – Pluto Tv", "ogType": "website", "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1", "ogTitle": "ROJADIRECTA TV - Fútbol en Vivo", "keywords": "ROJADIRECTA TV, ROJADIRECTATV, futbol en vivo, ver fútbol online, liga mx en vivo, mls en vivo, serie a en vivo, pirlo tv, rojadirecta, futbol gratis, Roja Directa TV EN VIVO, Roja Tv, Roja Directa TV Live, RojaDirecta TV Live, Tarjeta Roja", "ogSiteName": "ROJADIRECTA TV", "themeColor": "#e30909", "description": "RojaDirectaTv, PirloTv, Tarjetaroja Tv, Pluto Tv, Fútbol en Vivo es la web para ver fútbol en vivo, Mira los mejores partidos de fútbol en vivo: Liga MX, MLS, Serie A, Champions League y más deportes en directo. Programación deportiva gratis.", "twitterCard": "summary", "canonicalUrl": "https://www.rojadirectastream.blog", "ogDescription": "Mira los mejores partidos de fútbol en vivo gratis. Liga MX, MLS, Serie A y más deportes en directo." }, "mixed_content": { "no_sri": [ "https://platform-api.sharethis.com/js/sharethis.js", "https://waust.at/s.js" ], "third_party_scripts": 3 }, "status": { "up": true, "code": 200, "timings": { "dns": 811, "tls": 17, "wait": 18, "connect": 13, "download": 14 }, "response_ms": 873 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "carbon": { "bytes": 25387, "co2_grams": 0.0009, "cleaner_than": 52 }, "dns_server": { "ns": [ { "ip": "162.159.24.5", "host": "ns2.dyna-ns.net" }, { "ip": "162.159.26.92", "host": "ns1.dyna-ns.net" } ], "zone": "rojatvdirecta.dev" }, "location": { "ip": "45.81.21.31", "asn": "204615", "org": "IP Fiber Inc", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YR2", "subject": "rojatvdirecta.dev" }, "dns": { "A": [ "45.81.21.31" ], "NS": [ "ns1.dyna-ns.net", "ns2.dyna-ns.net" ], "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.rojatvdirecta.dev\", \"serial\": 2026100301, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "45.81.21.31", "family": 4 }, "redirects": { "chain": [ "https://rojatvdirecta.dev" ] }, "rank": { "domain": "rojatvdirecta.dev" }, "linked_pages": { "internal_count": 31 }, "headers": { "headers": { "content-type": "text/html; charset=UTF-8" } } } } ```