# PhishDestroy domain threat record: ww19.palcamps.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/ww19.palcamps.net/
Machine-readable companion: https://phishdestroy.io/domain/ww19.palcamps.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 15:05:15 UTC
- Last availability or vendor check: 2026-10-27 23:06:05 UTC
- Stored record updated: 2026-10-27 23:26:04 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 208.91.196.145
- Registrar in stored WHOIS data: Launchpad.com Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2015-08-20 18:40:10 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0fbe2-8e85-7598-878a-9a0c412b6dd1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/ww19.palcamps.net
- Certificate Transparency search: https://crt.sh/?q=%25.ww19.palcamps.net
- Web Archive lookup: https://web.archive.org/web/*/https://ww19.palcamps.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot shows a dark landing page headed by a site-name label and a Related Searches panel of outlined buttons, with a privacy policy link beneath them. PhishDestroy listed the hostname after a trusted report accepted on 2026-10-25, with first observation on 2026-10-25.

How the scam works
The buttons present unrelated popular search phrases as site navigation, so a visitor who clicks is carried off through the page's redirect chain instead of reaching a genuine service. As a category risk, related-search landing pages monetise or harvest traffic by pushing users toward third-party results, sponsored offers or credential forms. Nothing on the captured page disclosed who operated it or where a click would lead.

Evidence
The captured screenshot shows a Related Searches panel of outlined buttons offering digital library, camping reservations online, teen summer camps, campgrounds and RV parks, and camping for seniors over sixty, plus a privacy policy link; no login form or impersonated brand appeared, and VirusTotal did not flag the domain. urlscan's capture of 2026-10-02 gave an engines verdict of malicious with an ML score of 35 while its overall verdict was not malicious, and recorded a redirect funnel in which the parent domain issued a 302 into this hostname followed by http and https 307 bounces. Google Safe Browsing was not flagged on 2026-10-26, Spamhaus did not list it on 2026-10-25, OTX recorded 0 pulses on 2026-10-25, and external blocklists showed 0 listings on 2026-10-26 while PhishDestroy's internal listing was set. Page inspection recorded consent-management globals for TCF, GPP and USP APIs, tracker requests served by Clarity and Microsoft advertising code, and a document hash of 099132126957 for campaign pivoting.

Infrastructure
Weaknesses first: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP were all absent, and DNSSEC was unsigned. TLS 1.3 with AES-128-GCM; SPF present with no DKIM or DMARC; CAA present. No registrar data was recorded, hosting was recorded on the Confluence Networks Inc network on 2026-10-02 with Cowboy and openresty server headers, and the hostname carried a CNAME to a third-party search platform.

What to do
If you entered credentials or personal data on the captured page, change that password on the genuine service and enable two-factor authentication, then watch the account for unexpected activity. For defenders, block ww19.palcamps.net at the DNS or proxy layer, hunt for prior visits to it, and treat the PhishDestroy internal listing from 2026-10-26 as the operative signal despite negative external feeds.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0fbe2-8e85-7598-878a-9a0c412b6dd1/
Cloudflare Radar report: https://radar.cloudflare.com/scan/dae5e046-3ef4-4ceb-ae22-00ad53d63fcf
Stored capture screenshot: https://urlscan.io/screenshots/01a0fbe2-8e85-7598-878a-9a0c412b6dd1.png
Cloudflare Radar screenshot (2026-10-25T15:12:47Z): https://screenshots.phishdestroy.io/cf/dae5e046-3ef4-4ceb-ae22-00ad53d63fcf.png
VirusTotal report: https://www.virustotal.com/gui/domain/ww19.palcamps.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ww19.palcamps.net
Archived copy: https://web.archive.org/web/20261025153911/https://ww19.palcamps.net/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 21:04:26 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0fbe2-8e85-7598-878a-9a0c412b6dd1.png
  Captured: 2026-10-25 15:05:15 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0fbe2-8e85-7598-878a-9a0c412b6dd1.png
  Source report: https://urlscan.io/result/01a0fbe2-8e85-7598-878a-9a0c412b6dd1/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/dae5e046-3ef4-4ceb-ae22-00ad53d63fcf.png
  Captured: 2026-10-25 15:12:47 UTC
  Source report: https://radar.cloudflare.com/scan/dae5e046-3ef4-4ceb-ae22-00ad53d63fcf
  SHA-256: 04968682531ff8431d4ba43d41f9284b66b48877418c182a6975b4a3fd8faaa4

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T15:11:09Z",
        "uuid": "01a0fbe2-8e85-7598-878a-9a0c412b6dd1",
        "scanned_at": "2026-10-02T09:12:14Z",
        "final_url": "http://ww19.palcamps.net/",
        "status": 200,
        "redirected": "parent-domain",
        "redirects": [
            {
                "to": "https://palcamps.net/",
                "from": "https://palcamps.net/"
            },
            {
                "to": "http://ww19.palcamps.net/",
                "from": "https://palcamps.net/",
                "status": 302
            },
            {
                "to": "https://ww19.palcamps.net/",
                "from": "http://ww19.palcamps.net/",
                "status": 307
            },
            {
                "to": "http://ww19.palcamps.net/",
                "from": "https://ww19.palcamps.net/",
                "status": 307
            }
        ],
        "ip": "208.91.196.145",
        "domains": [
            "l.cdn-fileserver.com",
            "cdn.consentmanager.net",
            "d.delivery.consentmanager.net",
            "s.cdn-fileserver.com",
            "palcamps.net",
            "s.yimg.com",
            "msadsscale.microsoft.com",
            "scripts.clarity.ms",
            "searchresultsworld.com"
        ],
        "ips": [
            "188.114.96.3",
            "87.248.119.252",
            "150.171.109.106",
            "150.171.109.194",
            "104.21.26.182",
            "195.181.175.40",
            "85.9.206.5",
            "188.114.97.3",
            "208.91.196.145",
            "37.48.72.213"
        ],
        "asns": [
            "13335",
            "203220",
            "8075",
            "60068",
            "202053",
            "40034",
            "60781"
        ],
        "countries": [
            "GB",
            "US",
            "DE",
            "VG",
            "NL"
        ],
        "link_domains": [
            "findsearchresults.com",
            "skenzo.com"
        ],
        "doc_hash": "09913212695747b9984fb556d839d04466efe629212c36c26af5bcce18f05327",
        "globals": [
            "cmp_id",
            "cmp_cdid",
            "cmp_params",
            "cmp_host",
            "cmp_cdn",
            "cmp_proto",
            "cmp_codesrc",
            "cmp_getsupportedLangs",
            "cmp_getRTLLangs",
            "cmp_getlang",
            "cmp_addFrame",
            "cmp_rc",
            "cmp_stub",
            "cmp_gpp_ping",
            "cmp_gppstub",
            "cmp_msghandler",
            "cmp_setStub",
            "cmp_setGppStub",
            "__cmp",
            "__tcfapi",
            "__uspapi",
            "__gpp",
            "olaSyncCount",
            "__bdata",
            "checkDNS",
            "cmp_utillities",
            "cmp_gppmanifest",
            "cmp_fibo",
            "cmp_reader",
            "cmp_writer",
            "cmp_cs",
            "cmp_lang",
            "cmp_purpose",
            "cmp_feature",
            "cmp_stack",
            "cmp_vendor",
            "cmp_snapshot",
            "cmp_storage",
            "cmp_gpp_helper",
            "cmp_api"
        ],
        "cookies": [
            "sid",
            "__cmpcc",
            "__cmpconsentx175795",
            "__cmpcccx175795"
        ],
        "storage_keys": [
            "cmp_gpcConsentModeEligible.40679ccc92462",
            "__cmpconsentx175795_ww19.palcamps.net",
            "__cmpconsentx175795_expire_ww19.palcamps.net",
            "__cmpcccx175795_ww19.palcamps.net",
            "__cmpcccx175795_expire_ww19.palcamps.net"
        ],
        "tls": {
            "san": [
                "example.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "example.com",
            "subject": "example.com",
            "protocol": "TLS 1.3",
            "valid_to": "2036-03-18T04:15:51Z",
            "valid_from": "2026-03-21T04:15:51Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 3015,
        "requests": 23,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 35,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Cowboy",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T15:13:44Z",
        "uuid": "dae5e046-3ef4-4ceb-ae22-00ad53d63fcf",
        "scanned_at": "2026-10-25T15:12:47Z",
        "final_url": "https://ww19.palcamps.net/",
        "status": 200,
        "history": [
            {
                "url": "https://ww19.palcamps.net/",
                "status": 200
            }
        ],
        "dom_hash": "7a3010c1fcc8fdbd50abeb540b6a675dec2adaa4ae1b25eea4cb2b8b5cd73015",
        "doc_hash": "7797cfa32a5e3ef6564af0337bfd68ad831574176705690c9987dd6399020843",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "ww19.palcamps.net",
                "type": "CNAME",
                "value": "9145.searchmagnified.com"
            },
            {
                "name": "ww19.palcamps.net",
                "type": "CNAME",
                "value": "9145.searchmagnified.com"
            }
        ],
        "dnssec_valid": false,
        "ip": "208.91.196.145",
        "whois": {
            "registrar": "Launchpad.com Inc.",
            "created": "2015-08-20T20:40:10Z",
            "updated": "2026-10-02T02:17:37Z",
            "expires": "2027-08-20T20:40:10Z",
            "nameservers": [
                "ns1.brainydns.com",
                "ns2.brainydns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T15:43:30Z",
        "analysis_at": "2026-10-25T15:22:29Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "registrar": "Launchpad.com Inc.",
        "created": "2015-08-20T20:40:10Z",
        "expires": "2027-08-20T20:40:10Z",
        "updated": "2026-10-02T02:17:37Z",
        "first_seen": "2026-10-20T08:06:42Z",
        "dns": [
            {
                "ttl": 889,
                "type": "NS",
                "value": "ns2.cnomy.com"
            },
            {
                "ttl": 889,
                "type": "NS",
                "value": "ns1.cnomy.com"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "abuse.confluence-networks.com",
                "value": "ns1.cnomy.com"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "v=spf1 a -all"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "~",
                "priority": 300
            },
            {
                "ttl": 900,
                "type": "A",
                "value": "208.91.196.145"
            },
            {
                "ttl": 300,
                "type": "CNAME",
                "value": "9145.searchmagnified.com"
            }
        ],
        "dns_at": "2026-10-25T15:28:27Z",
        "cert": {
            "san": [
                "ww19.palcamps.net"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "serial": "1f28e9d35ba3040919dbca735b57cf63",
            "sha256": "27c2df594f41e4c6ff269c44001ea5dfbcb41c182a26b3e6c316e06405d45c3d",
            "subject": "ww19.palcamps.net",
            "valid_to": "2027-01-08T23:59:59Z",
            "valid_from": "2026-10-10T00:00:00Z"
        },
        "whois": {
            "registrar": "Launchpad.com Inc.",
            "registrar_iana_id": "955",
            "registrar_url": "http://www.launchpad.com",
            "created": "2015-08-20T20:40:10Z",
            "updated": "2026-09-25T21:26:33Z",
            "expires": "2027-08-20T20:40:10Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.brainydns.com",
                "ns2.brainydns.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T15:14:07Z",
        "mail_config": {
            "mx": [
                "~"
            ],
            "spf": "v=spf1 a -all",
            "spf_lookups": 1
        },
        "caa_records": {
            "domain": "ww19.palcamps.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-13T06:42:46Z",
            "first": "2026-10-07T13:51:05Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.18,
            "avg_page_bytes": 9577
        },
        "trackers": {
            "requests": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 3,
                "tls": 805,
                "wait": 238,
                "connect": 1145,
                "download": 0
            },
            "response_ms": 2191
        },
        "ports": {
            "open": [
                80
            ]
        },
        "carbon": {
            "bytes": 122,
            "co2_grams": 0,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "5.79.75.245",
                    "host": "ns2.magpiedns.com"
                },
                {
                    "ip": "208.115.247.143",
                    "host": "ns1.magpiedns.com"
                }
            ],
            "zone": "palcamps.net"
        },
        "location": {
            "ip": "208.91.196.145",
            "asn": "40034",
            "org": "Confluence Networks Inc",
            "city": "Road Town",
            "country": "VG"
        },
        "ssl": {
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "subject": "ww19.palcamps.net"
        },
        "dns": {
            "A": [
                "208.91.196.145"
            ],
            "MX": [
                "{\"exchange\": \"~\", \"priority\": 300}"
            ],
            "NS": [
                "ns2.cnomy.com",
                "ns1.cnomy.com"
            ],
            "PTR": [
                "ns1.cnomy.com"
            ],
            "SOA": "{\"nsname\": \"ns1.cnomy.com\", \"hostmaster\": \"abuse.confluence-networks.com\", \"serial\": 2011062801, \"refresh\": 3600, \"retry\": 900, \"expire\": 604800, \"minttl\": 86400}",
            "TXT": [
                "v=spf1 a -all"
            ],
            "CNAME": [
                "9145.searchmagnified.com"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": true
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "208.91.196.145",
            "family": 4
        },
        "whois": {
            "registrar": "Launchpad.com Inc.",
            "created": "2015-08-20T20:40:10Z",
            "updated": "2026-10-02T02:17:37Z",
            "expires": "2027-08-20T20:40:10Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.brainydns.com",
                "ns2.brainydns.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "openresty",
                "content-type": "text/html"
            }
        }
    }
}
```