# PhishDestroy domain threat record: ton.getthehat.online

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/ton.getthehat.online/
Machine-readable companion: https://phishdestroy.io/domain/ton.getthehat.online/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 01:44:29 UTC
- Last availability or vendor check: 2026-10-23 10:38:13 UTC
- Stored record updated: 2026-10-23 18:22:51 UTC
- VirusTotal detections in the stored snapshot: 4/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.67.220.33
- Registrar in stored WHOIS data: NAMECHEAP INC
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 303
- Registration date (registry RDAP, getthehat.online): 2026-09-06 19:20:10 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16698-fdb5-772d-9220-a3c836ec1524/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/ton.getthehat.online
- Certificate Transparency search: https://crt.sh/?q=%25.ton.getthehat.online
- Web Archive lookup: https://web.archive.org/web/*/https://ton.getthehat.online/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed ton.getthehat.online as a suspicious domain after an intake review flagged it for malicious detections. The domain was first seen by PhishDestroy on 2026-10-23. The page title captured on that date was “LinkVault — Login”. An HTTP 303 redirect was returned for the root URL, and a subsequent request to /login returned HTTP 200.

How the scam works
The classification does not confirm a specific fraud technique; it indicates that the site exhibits characteristics often abused for phishing or credential harvesting. Such pages typically imitate legitimate login portals to entice users to submit usernames, passwords, or other sensitive data. Because no form fields or submission behavior were observed, the exact mechanism remains uncertain.

Evidence
VirusTotal recorded four detections on 2026-10-22, with three vendors (CRDF, Kaspersky, SOCRadar) marking the domain malicious and one (DNS8) marking it suspicious. Google Safe Browsing checked on 2026-10-23 reported no flag. OpenPhish listed the domain as malicious on 2026-10-23. OTX showed zero pulses on the same day. URLScan captured the site on 2026-10-23, assigning a malicious engine score of 62 while its overall verdict was non‑malicious. Cloudflare Radar identified phishing activity in its scan on 2026-10-23.

Infrastructure
The recorded IP addresses were 172.67.220.33 and 104.21.24.196 (plus IPv6 2606:4700:3032::ac43:dc21 and 2606:4700:3036::6815:18c4) and the network was identified as Cloudflare, Inc. in Canada. The TLS certificate observed was issued by Google Trust Services, valid from 2026-09-07 to 2026-12-06. At the time of observation the domain age was 37 days and the apex age 45 days. A Cloudflare Web Application Firewall was present and HTTP/3 support was observed.

What to do
Visitors should avoid entering any credentials on the page; if credentials were entered, change them immediately and monitor associated accounts. Organizations should add the domain to block lists and threat‑intel feeds, and review logs for any connections to the recorded IP addresses. No further action is required if no interaction occurred.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16698-fdb5-772d-9220-a3c836ec1524/
Cloudflare Radar report: https://radar.cloudflare.com/scan/cb013fc5-6e7c-4e9c-bc49-51bf76f1022f
Stored capture screenshot: https://i.ibb.co/Pz5RjD5z/dc28f8f6956d.png
Cloudflare Radar screenshot (2026-10-23T01:54:44Z): https://screenshots.phishdestroy.io/cf/cb013fc5-6e7c-4e9c-bc49-51bf76f1022f.png
URLScan screenshot (2026-10-11T18:19:01Z): https://screenshots.phishdestroy.io/us/01a12c30-7621-7290-a2e4-749f5acf6fa6.png
URLScan capture report: https://urlscan.io/result/01a12c30-7621-7290-a2e4-749f5acf6fa6/
URLScan screenshot (2026-10-13T12:45:11Z): https://screenshots.phishdestroy.io/us/01a1354b-866b-726a-a29b-6c2c4bf6436d.png
URLScan capture report: https://urlscan.io/result/01a1354b-866b-726a-a29b-6c2c4bf6436d/
URLScan screenshot (2026-10-21T10:37:39Z): https://screenshots.phishdestroy.io/us/01a15e09-a72c-73c8-9670-167cf5f0b77a.png
URLScan capture report: https://urlscan.io/result/01a15e09-a72c-73c8-9670-167cf5f0b77a/
VirusTotal report: https://www.virustotal.com/gui/domain/ton.getthehat.online
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ton.getthehat.online
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 03:10:00 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Pz5RjD5z/dc28f8f6956d.png
  Captured: 2026-10-23 02:32:19 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a16698-fdb5-772d-9220-a3c836ec1524.png
  Captured: 2026-10-23 02:32:19 UTC
  Source report: https://urlscan.io/result/01a16698-fdb5-772d-9220-a3c836ec1524/
- URLScan capture 2: https://screenshots.phishdestroy.io/01a1664b-5fe7-7022-9615-f91bb3408460.png
  Captured: 2026-10-23 01:44:29 UTC
  Source report: https://urlscan.io/result/01a16698-fdb5-772d-9220-a3c836ec1524/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/cb013fc5-6e7c-4e9c-bc49-51bf76f1022f.png
  Captured: 2026-10-23 01:54:44 UTC
  Source report: https://radar.cloudflare.com/scan/cb013fc5-6e7c-4e9c-bc49-51bf76f1022f
  SHA-256: b910684810a767572c3d561735951f37e84ee70c87c05b7401e19e6d5e074f19
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12c30-7621-7290-a2e4-749f5acf6fa6.png
  Captured: 2026-10-11 18:19:01 UTC
  Source report: https://urlscan.io/result/01a12c30-7621-7290-a2e4-749f5acf6fa6/
  SHA-256: 384b1ad0ac059cf5db341026cb6dd709804ee7dadd445804b260ee16f37ffc7a
- URLScan · 2026-10-13: https://screenshots.phishdestroy.io/us/01a1354b-866b-726a-a29b-6c2c4bf6436d.png
  Captured: 2026-10-13 12:45:11 UTC
  Source report: https://urlscan.io/result/01a1354b-866b-726a-a29b-6c2c4bf6436d/
  SHA-256: f20eb544df9ee5f2980fd045d7ca71c3ce21830f916e96e08b7e34b7d9977b16
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15e09-a72c-73c8-9670-167cf5f0b77a.png
  Captured: 2026-10-21 10:37:39 UTC
  Source report: https://urlscan.io/result/01a15e09-a72c-73c8-9670-167cf5f0b77a/
  SHA-256: 27bab9344e1f13b36069f1d6da10bbcd5cd0f7fbd52f08071ef6c5ffb4e14202

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T02:34:39Z",
        "uuid": "01a16698-fdb5-772d-9220-a3c836ec1524",
        "scanned_at": "2026-10-23T02:31:10Z",
        "final_url": "https://ton.getthehat.online/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://ton.getthehat.online/",
                "from": "http://ton.getthehat.online/",
                "status": 307
            }
        ],
        "ip": "172.67.220.33",
        "ips": [
            "172.67.220.33"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "0a446ccc45515d51f2761550d3afc1af32061315fe780099f1a32d1e750cf1de",
        "tls": {
            "san": [
                "getthehat.online",
                "*.getthehat.online"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "getthehat.online",
            "protocol": "QUIC",
            "valid_to": "2026-12-06T02:22:05Z",
            "valid_from": "2026-09-07T01:23:13Z"
        },
        "domain_age_days": 37,
        "apex_age_days": 45,
        "tls_age_days": 46,
        "tls_valid_days": 90,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 62,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T01:58:32Z",
        "uuid": "cb013fc5-6e7c-4e9c-bc49-51bf76f1022f",
        "scanned_at": "2026-10-23T01:54:44Z",
        "final_url": "https://ton.getthehat.online/login",
        "status": 200,
        "redirected": "same-domain",
        "history": [
            {
                "url": "https://ton.getthehat.online/",
                "status": 303
            },
            {
                "url": "https://ton.getthehat.online/login",
                "status": 200
            }
        ],
        "dom_hash": "a7ef23b0bca6a9521bb5d766fca50fe3946b7d8ad4e4dbc146c41a2191233874",
        "doc_hash": "3e8ab15529f8d558b82ca2c2f082e7a78a965a58bba47c01107aa9732ce31cbd",
        "phishing_v2": [
            "phishing"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "ton.getthehat.online",
                "type": "A",
                "value": "104.21.24.196"
            },
            {
                "name": "ton.getthehat.online",
                "type": "A",
                "value": "172.67.220.33"
            },
            {
                "name": "ton.getthehat.online",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:dc21"
            },
            {
                "name": "ton.getthehat.online",
                "type": "AAAA",
                "value": "2606:4700:3036::6815:18c4"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.24.196",
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-09-06T19:20:10Z",
            "updated": "2026-09-11T19:20:39Z",
            "expires": "2027-09-06T19:20:10Z",
            "nameservers": [
                "clay.ns.cloudflare.com",
                "melina.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T03:01:34Z",
        "analysis_at": "2026-10-22T15:11:20Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 3,
            "suspicious": 1,
            "undetected": 36
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing"
        },
        "reputation": 0,
        "registrar": "NAMECHEAP INC",
        "created": "2026-09-06T19:20:10Z",
        "expires": "2027-09-06T19:20:10Z",
        "updated": "2026-09-11T19:20:39Z",
        "first_seen": "2026-09-07T20:27:36Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.220.33"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.24.196"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:dc21"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::6815:18c4"
            }
        ],
        "dns_at": "2026-10-22T15:16:37Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "getthehat.online",
                "*.getthehat.online"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "eb90cf3f08663551139b41025e9b7ae6",
            "sha256": "115aba91de7b306eb5a2fc4ef3e30057f22c47ac0b22590611ab290366d30783",
            "subject": "getthehat.online",
            "valid_to": "2026-12-06T02:22:05Z",
            "valid_from": "2026-09-07T01:23:13Z"
        },
        "whois": {
            "registrar": "NAMECHEAP INC",
            "registrar_iana_id": "1068",
            "registrar_url": "http://www.namecheap.com",
            "created": "2026-09-06T19:20:10Z",
            "updated": "1-01-01T00:00:00Z",
            "expires": "2027-09-06T19:20:10Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "clay.ns.cloudflare.com",
                "melina.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "registration": "2026-09-06T19:20:10Z",
                "registrar expiration": "2027-09-06T19:20:10Z",
                "last update of RDAP database": "2026-10-16T09:55:31Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T01:58:42Z",
        "caa_records": {
            "domain": "ton.getthehat.online"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "robots_txt": {
            "agents": [
                "*",
                "Amazonbot",
                "Applebot-Extended",
                "Bytespider",
                "CCBot"
            ],
            "present": true
        },
        "social_tags": {
            "title": "LinkVault — Login",
            "robots": "noindex,nofollow"
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 303,
            "timings": {
                "dns": 4,
                "tls": 24,
                "wait": 357,
                "connect": 24,
                "download": 0
            },
            "response_ms": 409
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 7636,
            "co2_grams": 0.0003,
            "cleaner_than": 78
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.38.184",
                    "host": "melina.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.59.88",
                    "host": "clay.ns.cloudflare.com"
                }
            ],
            "zone": "getthehat.online"
        },
        "location": {
            "ip": "2606:4700:3036::6815:18c4",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "getthehat.online"
        },
        "dns": {
            "A": [
                "104.21.24.196",
                "172.67.220.33"
            ],
            "AAAA": [
                "2606:4700:3036::6815:18c4",
                "2606:4700:3032::ac43:dc21"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3032::ac43:dc21",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://ton.getthehat.online",
                "/login"
            ],
            "count": 1
        },
        "tech_stack": {
            "technologies": [
                "Cloudflare",
                "HTTP/3"
            ]
        },
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-09-06T19:20:10Z",
            "updated": "2026-09-11T19:20:39Z",
            "expires": "2027-09-06T19:20:10Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "clay.ns.cloudflare.com",
                "melina.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```