# PhishDestroy domain threat record: search-melons.duckdns.org Content language: English Canonical HTML report: https://phishdestroy.io/domain/search-melons.duckdns.org/ Machine-readable companion: https://phishdestroy.io/domain/search-melons.duckdns.org/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-15 16:22:56 UTC - Last availability or vendor check: 2026-10-22 10:09:16 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 2/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 93.152.223.40 - Registrar in stored WHOIS data: Gandi SAS - Last stored HTTP status: 200 - Registration date (registry RDAP, duckdns.org): 2013-04-12 19:58:56 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/search-melons.duckdns.org - Certificate Transparency search: https://crt.sh/?q=%25.search-melons.duckdns.org - Web Archive lookup: https://web.archive.org/web/*/https://search-melons.duckdns.org/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview search-melons.duckdns.org is on the PhishDestroy blocklist. Its page is titled "Melon — OSINT поиск", which presents it as a Russian-language OSINT search service for looking up information about people or accounts. PhishDestroy first flagged it on 2026-09-15. As of 2026-10-19 the site was still online and serving content. How the scam works PhishDestroy has not assigned this domain a specific scheme type, so this report does not claim one. Unofficial OSINT lookup services carry a general risk. They ask visitors to type in names, phone numbers, usernames or other identifiers, and they sometimes request payment or a login before showing results. Anything entered on a page like this, including the details of the person being searched, should be treated as handed to an unknown operator. Evidence Independent detection is thin. On 2026-09-29, 2 of 91 VirusTotal engines flagged the domain, Forcepoint ThreatSeeker and LevelBlue, while the rest returned no verdict. Among blocklists, it appears only on PhishDestroy's. The two vendor hits support caution but do not by themselves establish what the site does. Infrastructure The site runs on a subdomain of DuckDNS, a free dynamic DNS service. Anyone can create such an address in minutes without registering a domain of their own, so the name says little about who operates it. The server sits at 93.152.223.40 on the RMP Protection Limited network in Germany. Its Let's Encrypt certificate only means the connection is encrypted and says nothing about whether the site can be trusted. What to do If you searched for someone on this site, assume the identifiers you typed are no longer private. If you created an account or reused a password there, change that password everywhere else it is used and turn on two-factor authentication. If you paid for a lookup, contact your card issuer or payment provider about the charge and watch for follow-up phishing that cites the details you entered. Defenders should block the hostname and the IP 93.152.223.40 at the proxy or DNS layer. They should also review logs for users who visited or submitted forms after 2026-09-15. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/search-melons.duckdns.org Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=search-melons.duckdns.org Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:47:28 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b6302efc-3df5-4e9d-8433-42048ea65757.png Captured: 2026-09-23 03:28:44 UTC Source report: https://radar.cloudflare.com/scan/b6302efc-3df5-4e9d-8433-42048ea65757 SHA-256: 7ea0987fe64e00e358eba516d3cab970c8ff139334fc4055b741244b9b08e54a - URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a5e5-80e7-7616-9c3c-43f46c9ad144.png Captured: 2026-09-15 16:28:03 UTC Source report: https://urlscan.io/result/01a0a5e5-80e7-7616-9c3c-43f46c9ad144/ SHA-256: 72935dfabe491fa7ae60c4a664d7e5aefb09ab99d19be80a8fa7771da76b101c ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:30:05Z", "uuid": "b6302efc-3df5-4e9d-8433-42048ea65757", "scanned_at": "2026-09-23T03:28:44Z", "final_url": "https://search-melons.duckdns.org/", "status": 200, "history": [ { "url": "https://search-melons.duckdns.org/", "status": 200 } ], "dom_hash": "5d658628f19edfbcdbd5971e9952c0cc63c3433a4d37b1abc6081615c07adb11", "doc_hash": "1a60c73e27d8db1ba1e82d27555dedd7e5f62591a271543363b843af88f5614d", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "search-melons.duckdns.org", "type": "A", "value": "93.152.223.40" } ], "dnssec_valid": false, "ip": "93.152.223.40", "whois": { "registrar": "Gandi SAS", "created": "2013-04-12T19:58:56Z", "updated": "2026-08-12T00:57:00Z", "expires": "2029-04-12T19:58:56Z", "nameservers": [ "ns1.duckdns.org", "ns2.duckdns.org", "ns3.duckdns.org", "ns5.duckdns.org", "ns6.duckdns.org", "ns4.duckdns.org" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T00:31:08Z", "analysis_at": "2026-09-29T02:00:16Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 2, "suspicious": 0, "undetected": 36 }, "detections": { "LevelBlue": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Sophos": "dynamic dns and isp sites", "Forcepoint ThreatSeeker": "phishing and other frauds" }, "registrar": "Gandi SAS", "created": "2013-04-12T19:58:56Z", "expires": "2029-04-12T19:58:56Z", "updated": "2026-08-12T00:57:00Z", "first_seen": "2026-09-13T08:11:23Z", "dns": [ { "ttl": 600, "type": "MX", "value": "search-melons.duckdns.org", "priority": 50 }, { "ttl": 60, "type": "TXT" }, { "ttl": 60, "type": "A", "value": "93.152.223.40" } ], "dns_at": "2026-09-29T02:00:33Z", "jarm": "27d40d40d00040d00042d43d000000d2e61cae37a985f75ecafb81b33ca523", "cert": { "san": [ "search-melons.duckdns.org" ], "issuer": "Let's Encrypt / YE2", "serial": "5c229f7b403bfc55eab98c660677d02c4d3", "sha256": "48400ca2ce91e4979ae10259b230722cf4d7cec3f326d7bece812684e5f07a1e", "subject": "search-melons.duckdns.org", "valid_to": "2026-12-14T10:01:40Z", "valid_from": "2026-09-15T10:01:41Z" }, "whois": { "registrar": "Gandi SAS", "registrar_iana_id": "81", "registrar_url": "http://www.gandi.net", "created": "2013-04-12T19:58:56Z", "updated": "2026-08-12T00:57:00Z", "expires": "2029-04-12T19:58:56Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1.duckdns.org", "ns2.duckdns.org", "ns3.duckdns.org", "ns4.duckdns.org", "ns5.duckdns.org", "ns6.duckdns.org", "ns7.duckdns.org", "ns8.duckdns.org", "ns9.duckdns.org" ], "dnssec": "unsigned" } } } ```