# PhishDestroy domain threat record: theguesstimate.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/theguesstimate.com/
Machine-readable companion: https://phishdestroy.io/domain/theguesstimate.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-11 08:36:29 UTC
- Last availability or vendor check: 2026-10-22 10:40:08 UTC
- Stored record updated: 2026-10-22 15:46:35 UTC
- VirusTotal detections in the stored snapshot: 13/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: spectrum

## Stored infrastructure

- Observed IP address: 50.6.4.145
- Registrar in stored WHOIS data: TLDS LLC. d/b/a SRSPlus
- Registrar country in stored WHOIS data: US
- Registration date (registry RDAP, theguesstimate.com): 2016-04-25 17:08:05 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a12a19-583d-7504-9cdf-6f48f82dbce7/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/theguesstimate.com
- Certificate Transparency search: https://crt.sh/?q=%25.theguesstimate.com
- Web Archive lookup: https://web.archive.org/web/*/https://theguesstimate.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
theguesstimate.com hosts a fake Spectrum sign-in page aimed at the internet, TV and mobile provider's customers. PhishDestroy first flagged it on 2026-10-11. As of 2026-10-19 the site was still online and the phishing content was live, so anyone landing on it now faces an active trap.

How the scam works
The page carries the title "Sign In to Get Started" and mimics a routine Spectrum login, which typically draws victims in through a link about billing, service changes or account verification. Whatever username and password are typed into the form go to the operators, not to Spectrum. With those credentials an attacker can read the associated email inbox, change account details, view billing and payment information, and reuse the password against other services where it was recycled.

Evidence
When checked on 2026-10-16, 13 of 92 VirusTotal engines classed the domain as malicious. They included Google Safe Browsing, ESET, Fortinet, Forcepoint ThreatSeeker, G-Data, CRDF, Gridinsoft and alphaMountain.ai. Google Safe Browsing lists it under SOCIAL_ENGINEERING, which is its category for deceptive phishing pages. urlscan.io returned a malicious verdict and identified Spectrum branding on the page. The domain also appears in 5 AlienVault OTX threat pulses and on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2016-04-25 through TLDS LLC. d/b/a SRSPlus, roughly ten years before it surfaced as a Spectrum lure. Its name has nothing to do with Spectrum, so an older domain is now carrying the phishing page. The site is hosted on Oracle Corporation's network in the US. It presents a Let's Encrypt certificate, so the browser padlock appears even though the page is fraudulent.

What to do
If you entered your Spectrum login on this site, sign in through Spectrum's official app or a manually typed address and change your password immediately. Then change it on every other account where you used the same password, especially the linked email account. Turn on two-factor authentication, review recent account activity and contact details for changes, and watch your billing for unfamiliar charges. Treat any follow-up calls or messages claiming to be Spectrum support with suspicion. Defenders should block the domain at DNS, proxy and email gateways, search mail logs for messages linking to it, and reset credentials for any users who visited.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a12a19-583d-7504-9cdf-6f48f82dbce7/
VirusTotal report: https://www.virustotal.com/gui/domain/theguesstimate.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=theguesstimate.com
Archived copy: https://web.archive.org/web/20261011082942/https://theguesstimate.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:26:52 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a12a19-583d-7504-9cdf-6f48f82dbce7.png
  Captured: 2026-10-11 08:36:29 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a12a19-583d-7504-9cdf-6f48f82dbce7.png
  Captured: 2026-10-11 08:36:29 UTC
  Source report: https://urlscan.io/result/01a12a19-583d-7504-9cdf-6f48f82dbce7/
- URLScan capture 2: https://urlscan.io/screenshots/01a1293a-6ea3-704f-aeef-243ae7551372.png
  Captured: 2026-10-11 08:27:06 UTC
  Source report: https://urlscan.io/result/01a12a19-583d-7504-9cdf-6f48f82dbce7/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c217bb93-c2fd-4144-a1f3-716be0fe4937.png
  Captured: 2026-10-12 10:41:45 UTC
  Source report: https://radar.cloudflare.com/scan/c217bb93-c2fd-4144-a1f3-716be0fe4937
  SHA-256: 5b685b6fd0c356b8389e33596a40c60d2f63ca6aac5f9ec6250f109105361924
- URLQuery: https://screenshots.phishdestroy.io/uq/19047c8b-7671-461c-a5b3-1c753dbb7f1c.png
  Source report: https://urlquery.net/report/19047c8b-7671-461c-a5b3-1c753dbb7f1c
  SHA-256: 45fbb57fc3a45958e490f64177155aec69c8b0c7b2bdc333e3a9081ddaefd07e
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a1287a-1b60-7207-b652-ff8054095374.png
  Captured: 2026-10-11 01:01:00 UTC
  Source report: https://urlscan.io/result/01a1287a-1b60-7207-b652-ff8054095374/
  SHA-256: de6fb93fb6e0884fcddf15380a39bfdc100f5f79b7111185dd5f2395695a6f4f
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a1293a-6ea3-704f-aeef-243ae7551372.png
  Captured: 2026-10-11 04:31:06 UTC
  Source report: https://urlscan.io/result/01a1293a-6ea3-704f-aeef-243ae7551372/
  SHA-256: de6fb93fb6e0884fcddf15380a39bfdc100f5f79b7111185dd5f2395695a6f4f
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12a15-19cd-70db-bc0c-26698b762723.png
  Captured: 2026-10-11 08:29:54 UTC
  Source report: https://urlscan.io/result/01a12a15-19cd-70db-bc0c-26698b762723/
  SHA-256: de6fb93fb6e0884fcddf15380a39bfdc100f5f79b7111185dd5f2395695a6f4f
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12ab1-48a7-77bc-8013-6215c0a373b1.png
  Captured: 2026-10-11 11:20:30 UTC
  Source report: https://urlscan.io/result/01a12ab1-48a7-77bc-8013-6215c0a373b1/
  SHA-256: de6fb93fb6e0884fcddf15380a39bfdc100f5f79b7111185dd5f2395695a6f4f
- URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a13976-47ac-7790-b409-085b1cc3440d.png
  Captured: 2026-10-14 08:10:25 UTC
  Source report: https://urlscan.io/result/01a13976-47ac-7790-b409-085b1cc3440d/
  SHA-256: de6fb93fb6e0884fcddf15380a39bfdc100f5f79b7111185dd5f2395695a6f4f

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:53:38Z",
        "uuid": "01a12a19-583d-7504-9cdf-6f48f82dbce7",
        "scanned_at": "2026-10-11T08:34:32Z",
        "final_url": "https://theguesstimate.com/camcam/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://theguesstimate.com/camcam",
                "from": "http://theguesstimate.com/camcam",
                "status": 307
            },
            {
                "to": "https://theguesstimate.com/camcam/",
                "from": "https://theguesstimate.com/camcam",
                "status": 301
            }
        ],
        "ip": "50.6.4.145",
        "ptr": "server.pronetlicensing.com",
        "domains": [
            "cdnjs.cloudflare.com"
        ],
        "ips": [
            "104.17.25.14",
            "50.6.4.145"
        ],
        "asns": [
            "13335",
            "31898"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "id.spectrum.net",
            "www.spectrum.com",
            "spectrum.com",
            "www.spectrum.net"
        ],
        "doc_hash": "2f5b521cf1033bf0fe1352014e9eb95281a2b18adce29ff29dcac1c9ffba57ed",
        "globals": [
            "$",
            "jQuery",
            "$jscomp"
        ],
        "tls": {
            "san": [
                "*.theguesstimate.com",
                "theguesstimate.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "theguesstimate.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-20T06:01:58Z",
            "valid_from": "2026-08-22T06:01:59Z"
        },
        "domain_age_days": 2775,
        "apex_age_days": 2775,
        "tls_age_days": 50,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 93,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "spectrum"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Spectrum"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:43:57Z",
        "uuid": "c217bb93-c2fd-4144-a1f3-716be0fe4937",
        "scanned_at": "2026-10-12T10:41:45Z",
        "final_url": "https://theguesstimate.com/",
        "status": 200,
        "history": [
            {
                "url": "https://theguesstimate.com/",
                "status": 200
            }
        ],
        "dom_hash": "a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e",
        "domain_risks": [
            "Audio Streaming",
            "Entertainment"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "theguesstimate.com",
                "type": "A",
                "value": "50.6.4.145"
            }
        ],
        "dnssec_valid": false,
        "ip": "50.6.4.145",
        "whois": {
            "registrar": "TLDS L.L.C. d/b/a SRSPlus",
            "created": "2016-04-25T17:08:05Z",
            "updated": "2026-04-25T18:17:41Z",
            "expires": "2027-04-25T17:08:05Z",
            "nameservers": [
                "ns1.theguesstimate.com",
                "ns2.theguesstimate.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T02:36:59Z",
        "analysis_at": "2026-10-16T02:00:24Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 2,
            "suspicious": 2,
            "undetected": 34
        },
        "detections": {
            "SOCRadar": "suspicious",
            "URLQuery": "suspicious",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Business/Economy, Phishing (alphaMountain.ai)"
        },
        "registrar": "TLDS L.L.C. d/b/a SRSPlus",
        "created": "2016-04-25T17:08:05Z",
        "expires": "2027-04-25T17:08:05Z",
        "updated": "2026-04-25T18:17:41Z",
        "first_seen": "2024-03-04T16:54:04Z",
        "dns": [
            {
                "ttl": 14400,
                "type": "MX",
                "value": "theguesstimate.com",
                "priority": 0
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "50.6.4.145"
            },
            {
                "ttl": 8334,
                "type": "SOA",
                "rname": "allenk1101.comcast.net",
                "value": "ns3.regdesigns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns3.regdesigns.com"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 ip4:50.6.4.145 +a +mx +ip4:192.158.237.171 ~all"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns4.regdesigns.com"
            }
        ],
        "dns_at": "2026-10-16T02:00:41Z",
        "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b",
        "cert": {
            "san": [
                "*.theguesstimate.com",
                "theguesstimate.com"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "51a73b2e7b7a20121df09b89e1d044235f6",
            "sha256": "59f329c1a78b6ded91466cc95d5c499a6242b65ee6166c3edbf233ea96422c8c",
            "subject": "theguesstimate.com",
            "valid_to": "2026-11-20T06:01:58Z",
            "valid_from": "2026-08-22T06:01:59Z"
        },
        "whois": {
            "registrar": "TLDS L.L.C. d/b/a SRSPlus",
            "registrar_iana_id": "320",
            "registrar_url": "http://www.srsplus.com",
            "created": "2016-04-25T17:08:05Z",
            "updated": "2026-04-25T18:17:41Z",
            "expires": "2027-04-25T17:08:05Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.theguesstimate.com",
                "ns2.theguesstimate.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-04-25T17:08:05Z",
                "last changed": "2026-04-25T18:17:41Z",
                "registration": "2016-04-25T17:08:05Z",
                "last update of RDAP database": "2026-10-10T17:45:04Z"
            }
        }
    }
}
```