# PhishDestroy domain threat record: stem.edu.pk

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/stem.edu.pk/
Machine-readable companion: https://phishdestroy.io/domain/stem.edu.pk/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-19 06:43:41 UTC
- Last availability or vendor check: 2026-10-23 22:41:16 UTC
- Stored record updated: 2026-10-23 23:55:23 UTC
- VirusTotal detections in the stored snapshot: 6/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 210.56.25.100
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2017-08-10 22:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0b870-789f-736b-9a45-89c6d4e08faf/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/stem.edu.pk
- Certificate Transparency search: https://crt.sh/?q=%25.stem.edu.pk
- Web Archive lookup: https://web.archive.org/web/*/https://stem.edu.pk/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
stem.edu.pk is a Pakistani academic-zone domain that served a credential phishing page titled "Login - Rakuten", built to look like the sign-in screen of the Japanese e-commerce and rewards giant. Its targets are Rakuten customers, whose accounts can hold stored payment cards, points balances and order history. PhishDestroy first flagged it on 2026-09-19. As of 2026-10-19 the server still responds, but the phishing content no longer loads.

How the scam works
Victims reach the page through a link, typically in an email or text claiming an order problem, a locked account or expiring points. The page imitates Rakuten's login form and asks for an email address and password, and urlscan.io also matched a generic email-login template, so the kit may ask for the victim's mailbox password as well. Anything typed in goes straight to the operators. With a Rakuten login they can spend saved cards or points. With the email password they can reset other accounts tied to that inbox.

Evidence
urlscan.io rated the page malicious and identified Rakuten branding alongside a generic email-login lure. On VirusTotal, 6 of 91 engines flagged the domain as of 2026-09-30: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and VIPRE. That is a modest share, so many browsers and filters may not warn visitors. Three AlienVault OTX threat pulses reference the domain, and it is listed on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2017-08-11, more than nine years before the phishing page appeared. An education-sector domain of that age is a very different profile from a throwaway domain registered days before an attack. It resolves to 210.56.25.100 on a network belonging to the Commission on Science and Technology in Pakistan. The padlock came from a free Let's Encrypt certificate. It encrypts the connection but says nothing about who runs the page.

What to do
If you entered your Rakuten login here, change that password from Rakuten's official app or site, and change it anywhere else you reused it. Turn on two-factor authentication and check recent orders, saved cards and points balance. If you also typed your email password, change it first, enable 2FA, and review forwarding rules and active sessions. Contact your card issuer about any unfamiliar charges. Defenders should block the domain and IP at mail and web gateways, search mail logs for links to it, and reset credentials for any users who clicked.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0b870-789f-736b-9a45-89c6d4e08faf/
VirusTotal report: https://www.virustotal.com/gui/domain/stem.edu.pk
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=stem.edu.pk
Archived copy: https://web.archive.org/web/20260922125546/https://stem.edu.pk/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:39:49 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/fVh73R9m/c53657f6eebb.png
  Captured: 2026-09-19 06:54:27 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0b870-789f-736b-9a45-89c6d4e08faf.png
  Captured: 2026-09-19 06:54:27 UTC
  Source report: https://urlscan.io/result/01a0b870-789f-736b-9a45-89c6d4e08faf/
- URLScan capture 2: https://urlscan.io/screenshots/01a0b49c-2f46-7608-94e9-3717b2046b48.png
  Captured: 2026-09-19 06:43:41 UTC
  Source report: https://urlscan.io/result/01a0b870-789f-736b-9a45-89c6d4e08faf/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/2accd2a0-2005-4c05-82b9-3f53ca7b42a6.png
  Captured: 2026-09-19 06:45:54 UTC
  Source report: https://radar.cloudflare.com/scan/2accd2a0-2005-4c05-82b9-3f53ca7b42a6
  SHA-256: e1e1a102eaba1a55e723913e1b60b5921cd7f319271b7614a9db18f676b5dcd2
- URLScan · 2026-08-24: https://screenshots.phishdestroy.io/us/01a033af-e5e8-700f-a1f0-4dbecf1e960b.png
  Captured: 2026-08-24 12:12:53 UTC
  Source report: https://urlscan.io/result/01a033af-e5e8-700f-a1f0-4dbecf1e960b/
  SHA-256: 924b4b09d3f71d1de4e95cf3568507d4ce76e3a0784927dd47570d217333fe8a
- URLScan · 2026-08-24: https://screenshots.phishdestroy.io/us/01a035bd-f1f3-75fa-b9b5-3deed84d3a00.png
  Captured: 2026-08-24 21:47:34 UTC
  Source report: https://urlscan.io/result/01a035bd-f1f3-75fa-b9b5-3deed84d3a00/
  SHA-256: 3ea4a1088db625bd639df6a33a187cfa48d9b36cfdbf17a1c386429eb3ef88a1
- URLScan · 2026-08-24: https://screenshots.phishdestroy.io/us/01a035f4-979c-713c-a9e8-f89b8838eaf6.png
  Captured: 2026-08-24 22:47:26 UTC
  Source report: https://urlscan.io/result/01a035f4-979c-713c-a9e8-f89b8838eaf6/
  SHA-256: b9a9b12937ddbb0ecfa0056c6759eebae9c6827f161369cf07936057d9627070
- URLScan · 2026-08-24: https://screenshots.phishdestroy.io/us/01a03613-d670-71db-ae88-4d9b8485defd.png
  Captured: 2026-08-24 23:21:20 UTC
  Source report: https://urlscan.io/result/01a03613-d670-71db-ae88-4d9b8485defd/
  SHA-256: 531bd330d6bce31c3686719932a2def93f1e8528dfb594bab4cfb45a23b3aad8

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:27:30Z",
        "uuid": "01a0b870-789f-736b-9a45-89c6d4e08faf",
        "scanned_at": "2026-09-19T06:53:04Z",
        "final_url": "https://stem.edu.pk/rkt/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://stem.edu.pk/rkt",
                "from": "http://stem.edu.pk/rkt",
                "status": 307
            },
            {
                "to": "https://stem.edu.pk/rkt/",
                "from": "https://stem.edu.pk/rkt",
                "status": 301
            }
        ],
        "ip": "210.56.25.100",
        "domains": [
            "code.jquery.com",
            "login.account.rakuten.com",
            "maxcdn.bootstrapcdn.com",
            "rat.rakuten.co.jp",
            "cdn.jsdelivr.net",
            "cdnjs.cloudflare.com",
            "kit.fontawesome.com",
            "fonts.googleapis.com",
            "ajax.googleapis.com"
        ],
        "ips": [
            "23.3.89.105",
            "2.16.204.93",
            "104.17.208.5",
            "104.17.25.14",
            "104.18.40.68",
            "104.18.11.207",
            "151.101.129.155",
            "142.251.20.95",
            "210.56.25.100"
        ],
        "asns": [
            "20940",
            "13335",
            "54113",
            "15169",
            "7590"
        ],
        "countries": [
            "DE",
            "US",
            "PK"
        ],
        "link_domains": [
            "www.xfinity.com",
            "corp.rakuten.co.jp",
            "privacy.rakuten.co.jp",
            "login.account.rakuten.com",
            "ichiba.faq.rakuten.net"
        ],
        "doc_hash": "37b5ec46811fdc55ab1186df1620476f5f5eab615f70bcda41c66125e0fb9793",
        "script_hashes": [
            "f42c651f40506acb6b662490f338dd47a5951d3312039c4ab8fe5090484f351a",
            "b49abcffcad2b47800f9dbcdf72c5e2219c37d4619a771ea87b25f23a8425d9f",
            "7418f0131495bb16a3a4f1910ba51a550344122c37f857887cf6f11e7067269f",
            "82ea719549e7a3ec976535c4daa6b3524fd732c70e9754d8bcf827786536a4d7"
        ],
        "globals": [
            "$",
            "jQuery",
            "Elm",
            "__r10",
            "zxcvbn",
            "Fingerprint2Shrinked",
            "Rakuten",
            "Popper",
            "bootstrap",
            "_0x1118",
            "_0x2f31cb",
            "_0x38a0",
            "regeneratorRuntime",
            "allCookies"
        ],
        "cookies": [
            "__session:0.059654157194448665:",
            "Rp",
            "rat_v"
        ],
        "storage_keys": [
            "r10-ulid",
            "__storage_test__",
            "__test__",
            "r10-ml-analytics",
            "seenOnetimeAnnouncements"
        ],
        "tls": {
            "san": [
                "cpanel.stem.edu.pk",
                "mail.stem.edu.pk",
                "stem.edu.pk",
                "webdisk.stem.edu.pk",
                "webmail.stem.edu.pk"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "webdisk.stem.edu.pk",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-02T11:12:59Z",
            "valid_from": "2026-08-04T11:13:00Z"
        },
        "domain_age_days": 3024,
        "apex_age_days": 3024,
        "tls_age_days": 45,
        "tls_valid_days": 89,
        "requests": 23,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -33,
                "malicious": false
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "genericemail",
                    "rakuten"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Generic Email",
                    "Rakuten"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:33:58Z",
        "uuid": "2accd2a0-2005-4c05-82b9-3f53ca7b42a6",
        "scanned_at": "2026-09-19T06:45:54Z",
        "final_url": "https://stem.edu.pk/",
        "status": 200,
        "history": [
            {
                "url": "https://stem.edu.pk/",
                "status": 200
            }
        ],
        "dom_hash": "82538668c443453cd76b40793a36427e6568f4eb3a660109d340c1a48dff5c6e",
        "doc_hash": "eaf4d9f9f6cc8a29ff7410832588be88723891ae75318f3a49fe5acb740ec583",
        "domain_risks": [
            "Educational Institutions",
            "Education",
            "Science"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "stem.edu.pk",
                "type": "A",
                "value": "210.56.25.100"
            }
        ],
        "dnssec_valid": false,
        "ip": "210.56.25.100",
        "whois": {
            "created": "2017-08-11T00:00:00Z",
            "expires": "2027-08-11T00:00:00Z",
            "nameservers": [
                "n1.comsats.net.pk",
                "n2.comsats.net.pk"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T04:50:47Z",
        "analysis_at": "2026-10-20T09:40:31Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 7,
            "suspicious": 0,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "phishing",
            "Lionic": "phishing",
            "SOCRadar": "phishing",
            "Gridinsoft": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "popularity": {
            "Alexa": 519350,
            "Statvoo": 519350,
            "Majestic": 910266,
            "Cisco Umbrella": 939592,
            "Cloudflare Radar": 1000000
        },
        "created": "2017-08-11T00:00:00Z",
        "first_seen": "2024-02-05T05:40:01Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "root.isb.comsats.net.pk",
                "value": "n1.comsats.net.pk"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "n1.comsats.net.pk"
            },
            {
                "ttl": 21600,
                "type": "MX",
                "value": "filter.comsats.net.pk",
                "priority": 15
            },
            {
                "ttl": 21600,
                "type": "MX",
                "value": "mailf.comsats.net.pk",
                "priority": 10
            },
            {
                "ttl": 21600,
                "type": "A",
                "value": "210.56.25.100"
            },
            {
                "ttl": 21600,
                "type": "TXT",
                "value": "v=spf1 mx a ip4:210.56.9.185 a:symantec12.comsats.net.pk ?all"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "n2.comsats.net.pk"
            },
            {
                "ttl": 21600,
                "type": "MX",
                "value": "mailf.comsats.net.pk",
                "priority": 5
            }
        ],
        "dns_at": "2026-10-20T09:40:57Z",
        "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b",
        "cert": {
            "san": [
                "cpanel.stem.edu.pk",
                "mail.stem.edu.pk",
                "stem.edu.pk",
                "webdisk.stem.edu.pk",
                "webmail.stem.edu.pk"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "51fc5eecffc45bcc860c485060b8b9df69d",
            "sha256": "b965ec6ee652e00e18578fe490c312b9533fc12d859ab962d9a977c27f6e0ccd",
            "subject": "mail.stem.edu.pk",
            "valid_to": "2027-01-17T05:13:06Z",
            "valid_from": "2026-10-19T05:13:07Z"
        },
        "whois": {
            "created": "2017-08-11T00:00:00Z",
            "nameservers": [
                "n1.comsats.net.pk",
                "n2.comsats.net.pk"
            ]
        }
    }
}
```