# ruralbankofdulag.com — Recorded security evidence | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/ruralbankofdulag.com/ Machine-readable companion: https://phishdestroy.io/domain/ruralbankofdulag.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: Last known active - First observed by PhishDestroy: 2026-08-26 10:48:45 UTC - Selected availability observation: 2026-11-05T23:22:52Z - Stored record updated: 2026-11-06 15:23:50 UTC - VirusTotal detections in the stored snapshot: 13/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored labels and detections - Automated brand label (collector metadata; not a confirmed impersonation finding): microsoft ## Stored infrastructure - Observed IP address: 192.185.146.108 - Registrar in stored WHOIS data: FastDomain Inc. - Registrar country in stored WHOIS data: US - Last stored HTTP status: 200 (observed: 2026-11-05T23:22:52Z) - Registration date (registry RDAP, ruralbankofdulag.com): 2011-08-07 11:15:47 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a03dae-4087-772d-a9ac-c0d153c7b1c4/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/ruralbankofdulag.com - Certificate Transparency search: https://crt.sh/?q=%25.ruralbankofdulag.com - Web Archive lookup: https://web.archive.org/web/*/https://ruralbankofdulag.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy stores a record for ruralbankofdulag.com. Source observations are dated separately; missing checks do not establish safety. PhishDestroy stores a record for ruralbankofdulag.com. Source observations are dated separately; missing checks do not establish safety. A reviewed analysis is not available for this text revision. Consult the dated source records below. Package revision: 9e0761bff40a55641763dc3f7c64d21ec9b29f62d7ee84c8a7b29f614ff22cc3 Source facts (timestamps as stored): {"record_id":641384,"first_recorded_at":"2026-08-26 12:48:45","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":13,"denominator":92,"malicious":13,"suspicious":0,"vendors":{"CRDF":"malicious","DNS8":"phishing","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","CyRadar":"phishing","SOCRadar":"phishing","Seclookup":"malicious","Gridinsoft":"phishing","BitDefender":"phishing","Chong Lua Dao":"malicious","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"observed_at":"2026-10-19T12:18:09Z","checked_at":null,"fetched_at":"2026-10-23T15:03:00Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":11,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","BitDefender","Chong Lua Dao","CRDF","CyRadar","Forcepoint ThreatSeeker","G-Data","Gridinsoft","Seclookup","SOCRadar","VIPRE"],"observed_at":null,"checked_at":"2026-10-07 04:11:05","fetched_at":"2026-10-07 02:11:06","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"CRDF":"malicious","DNS8":"phishing","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","CyRadar":"phishing","SOCRadar":"phishing","Seclookup":"malicious","Gridinsoft":"phishing","BitDefender":"phishing","Chong Lua Dao":"malicious","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"vendor_names":["CRDF","DNS8","VIPRE","G-Data","Lionic","CyRadar","SOCRadar","Seclookup","Gridinsoft","BitDefender","Chong Lua Dao","alphaMountain.ai","Forcepoint ThreatSeeker"],"stats":{"timeout":0,"harmless":47,"malicious":13,"suspicious":0,"undetected":32}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-02 18:01:48"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-10-26 00:30:28"},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"current_http_probe","record_id":641384,"scope":"checked_url","observed_at":"2026-11-05T23:22:52Z","http_status":200,"http_observed_at":"2026-11-05T23:22:52Z","stored_http_code":200,"stored_http_observed_at":"2026-11-05T23:22:52Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"served_at_root","content_classification_at":"2026-11-05T02:59:17Z","registration_state":"unknown","policy":"20261102-dated-availability-v2"}} ## Stored page captures - Stored capture: https://i.ibb.co/8LK5YDDQ/26fc2074d821.png - URLScan · 2026-08-26: https://screenshots.phishdestroy.io/01a03dae-4087-772d-a9ac-c0d153c7b1c4.png Captured: 2026-08-26 10:47:35 UTC Source report: https://urlscan.io/result/01a03dae-4087-772d-a9ac-c0d153c7b1c4/ - URLQuery: https://screenshots.phishdestroy.io/uq/d8cacb71-bca1-4df8-9c31-a319840092ee.png Captured: 2026-08-26 11:12:03 UTC Source report: https://urlquery.net/report/d8cacb71-bca1-4df8-9c31-a319840092ee SHA-256: 312e925095bdab4c9f6ecf1659a3240fea6eb3049680c8c5e25c58b0fb9277c9 - URLScan · 2026-08-30: https://screenshots.phishdestroy.io/us/01a052df-b009-778d-a65b-34b4418d1f18.png Captured: 2026-08-30 13:33:15 UTC Source report: https://urlscan.io/result/01a052df-b009-778d-a65b-34b4418d1f18/ SHA-256: b8709c5a65711c2dc9e7a0e5b222db6e31900b9d48a6412ea6074da425d8fd39 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ff3498f5-6c0b-4bef-94a5-99cb8f34eb5e.png Captured: 2026-08-26 11:30:27 UTC Source report: https://radar.cloudflare.com/scan/ff3498f5-6c0b-4bef-94a5-99cb8f34eb5e SHA-256: a2c1fa3721e499fdff67aa9e8d948be992fa7a8a9a1414ea40c773d487275c1f ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:30:52Z", "uuid": "01a03dae-4087-772d-a9ac-c0d153c7b1c4", "scanned_at": "2026-08-26T10:47:35Z", "final_url": "https://ruralbankofdulag.com/shakebody/shakebody/", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://ruralbankofdulag.com/shakebody/shakebody", "from": "http://ruralbankofdulag.com/shakebody/shakebody", "status": 307 }, { "to": "https://ruralbankofdulag.com/shakebody/shakebody/", "from": "https://ruralbankofdulag.com/shakebody/shakebody", "status": 301 } ], "ip": "192.185.146.108", "ptr": "192-185-146-108.unifiedlayer.com", "ips": [ "192.185.146.108" ], "asns": [ "19871" ], "countries": [ "US" ], "doc_hash": "1ba67023b9418ab9cc4f40885b467fab979c2728fdeb266988bab7dc57223319", "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart", "isBot", "getEmail" ], "tls": { "san": [ "*.ruralbankofdulag.com", "ruralbankofdulag.com" ], "cipher": "AES_256_GCM", "issuer": "YR2", "subject": "ruralbankofdulag.com", "protocol": "TLS 1.3", "valid_to": "2026-10-21T15:55:43Z", "valid_from": "2026-07-23T15:55:44Z" }, "domain_age_days": 2865, "apex_age_days": 2865, "tls_age_days": 33, "tls_valid_days": 89, "requests": 2, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 85, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T05:58:45Z", "uuid": "ff3498f5-6c0b-4bef-94a5-99cb8f34eb5e", "scanned_at": "2026-08-26T11:30:27Z", "final_url": "https://ruralbankofdulag.com/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://ruralbankofdulag.com/", "status": 307 }, { "url": "https://ruralbankofdulag.com/", "status": 200 } ], "dom_hash": "ef1b8689101b2cb723336fc6e76248857b0d562324489305d47648e43b179c77", "doc_hash": "88a99a488166b36d7dd4f03f50b26122feefef9bc5a6b30e17293c3d3f0f61fa", "domain_risks": [ "Personal Finance", "Business & Economy" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "ruralbankofdulag.com", "type": "A", "value": "192.185.146.108" } ], "dnssec_valid": false, "ip": "192.185.146.108", "whois": { "registrar": "Bluehost Inc.", "created": "2011-08-07T11:15:47Z", "updated": "2026-07-23T10:20:14Z", "expires": "2027-08-07T11:15:47Z", "nameservers": [ "ns1.flutterhost.com", "ns2.flutterhost.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T15:03:00Z", "analysis_at": "2026-10-19T12:18:09Z", "stats": { "timeout": 0, "harmless": 47, "malicious": 13, "suspicious": 0, "undetected": 32 }, "detections": { "CRDF": "malicious", "DNS8": "phishing", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "CyRadar": "phishing", "SOCRadar": "phishing", "Seclookup": "malicious", "Gridinsoft": "phishing", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Business/Economy, Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds. financial data and services" }, "popularity": { "Alexa": 624257, "Statvoo": 624257 }, "registrar": "Bluehost Inc.", "created": "2011-08-07T11:15:47Z", "expires": "2027-08-07T11:15:47Z", "updated": "2026-08-03T17:55:57Z", "first_seen": "2023-11-29T12:33:04Z", "dns": [ { "ttl": 21600, "type": "SOA", "rname": "imelda_andales.yahoo.com", "value": "ns1.flutterhost.com" }, { "ttl": 21600, "type": "NS", "value": "ns2.flutterhost.com" }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 a mx include:websitewelcome.com ~all" }, { "ttl": 14400, "type": "MX", "value": "ruralbankofdulag.com", "priority": 0 }, { "ttl": 21600, "type": "NS", "value": "ns1.flutterhost.com" }, { "ttl": 14400, "type": "A", "value": "192.185.146.108" } ], "dns_at": "2026-10-19T12:21:01Z", "jarm": "29d29d15d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1", "cert": { "san": [ "*.ruralbankofdulag.com", "ruralbankofdulag.com" ], "issuer": "Let's Encrypt / YR1", "serial": "61d0a793b416bbb23299e1db72c5442172b", "sha256": "6b8f4f6c2f1de3360489e80ec2fd95d11e378ba076f044d7ef80add76598567c", "subject": "*.ruralbankofdulag.com", "valid_to": "2026-12-21T15:55:42Z", "valid_from": "2026-09-22T15:55:43Z" }, "whois": { "registrar": "Bluehost Inc.", "registrar_iana_id": "1154", "registrar_url": "http://www.netfirms.com/", "created": "2011-08-07T11:15:47Z", "updated": "2026-07-23T10:20:14Z", "expires": "2025-08-07T11:15:47Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1.flutterhost.com", "ns2.flutterhost.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-08-07T11:15:47Z", "last changed": "2026-07-23T10:20:14Z", "registration": "2011-08-07T11:15:47Z", "last update of RDAP database": "2026-10-15T04:54:41Z" } } } } ``` ## Complete dated records Availability observations: https://phishdestroy.io/domain/ruralbankofdulag.com/records.json?source=availability&format=json Source observation history: https://phishdestroy.io/domain/ruralbankofdulag.com/records.json?source=detections&format=json PhishStats records: https://phishdestroy.io/domain/ruralbankofdulag.com/records.json?source=phishstats&format=json Sent report records: https://phishdestroy.io/domain/ruralbankofdulag.com/records.json?source=sent_reports&format=json Report history: https://phishdestroy.io/domain/ruralbankofdulag.com/records.json?source=report_history&format=json Repeat report records: https://phishdestroy.io/domain/ruralbankofdulag.com/records.json?source=rereports&format=json Follow-up records: https://phishdestroy.io/domain/ruralbankofdulag.com/records.json?source=followups&format=json Content observations: https://phishdestroy.io/domain/ruralbankofdulag.com/records.json?source=content&format=json ## Dated availability observation Latest stored reachability observation ```json { "state": "alive", "label_key": "availability.active", "detail_key": "detail.latest_reachability", "params": [], "source": "current_http_probe", "record_id": 641384, "scope": "checked_url", "observed_at": "2026-11-05T23:22:52Z", "http_status": 200, "http_observed_at": "2026-11-05T23:22:52Z", "stored_http_code": 200, "stored_http_observed_at": "2026-11-05T23:22:52Z", "legacy_site_status": "alive", "supports_outcome_badge": false, "content_classification": "served_at_root", "content_classification_at": "2026-11-05T02:59:17Z", "registration_state": "unknown", "policy": "20261102-dated-availability-v2" } ```