Seguridad de dominio e inteligencia sobre amenazas

ww19.palcamps.net

Name: ww19.palcamps.net — PhishDestroy evidence record
Published: 2026-10-25
License: https://creativecommons.org/licenses/by/4.0/

Revisar las pruebas

Registrador: Launchpad.com
Dirección IP: 208.91.196.145Confluence Networks Inc
Registrado: 20/08/2015
Observado por primera vez: 25/10/2026

Evaluación de PhishDestroy Alto

63/100

Puntuación de evidencias

Disponibilidad Última vez que se supo que estaba activo Última observación de accesibilidad almacenada Observado 27 oct 2026 · 23:06 UTCSondeo HTTP

Señales de riesgo

Lista de amenazas de PhishDestroy almacenada

VirusTotal

0 / 92

detecciones del motor · 2026-10-25

URLScan

Malicioso

veredicto de los motores · puntuación 35

Capturas de la página

abrir galería

Antigüedad del dominio

4.086 días

Resumen del informe

ww19.palcamps.net — Última vez que se supo que estaba activo (HTTP 200). Resumen de las pruebas: VirusTotal 0/92; PhishDestroy score 63/100. Registrador…

El análisis detallado de PhishDestroy AI se mantiene en inglés para conservar el registro forense original.

Análisis

Informe sobre la amenaza PhishDestroy2026-10-26 21:04:26 UTC

Overview

The captured screenshot shows a dark landing page headed by a site-name label and a Related Searches panel of outlined buttons, with a privacy policy link beneath them. PhishDestroy listed the hostname after a trusted report accepted on 2026-10-25, with first observation on 2026-10-25.

How the scam works

The buttons present unrelated popular search phrases as site navigation, so a visitor who clicks is carried off through the page's redirect chain instead of reaching a genuine service. As a category risk, related-search landing pages monetise or harvest traffic by pushing users toward third-party results, sponsored offers or credential forms. Nothing on the captured page disclosed who operated it or where a click would lead.

Pruebas

The captured screenshot shows a Related Searches panel of outlined buttons offering digital library, camping reservations online, teen summer camps, campgrounds and RV parks, and camping for seniors over sixty, plus a privacy policy link; no login form or impersonated brand appeared, and VirusTotal did not flag the domain. urlscan's capture of 2026-10-02 gave an engines verdict of malicious with an ML score of 35 while its overall verdict was not malicious, and recorded a redirect funnel in which the parent domain issued a 302 into this hostname followed by http and https 307 bounces. Google Safe Browsing was not flagged on 2026-10-26, Spamhaus did not list it on 2026-10-25, OTX recorded 0 pulses on 2026-10-25, and external blocklists showed 0 listings on 2026-10-26 while PhishDestroy's internal listing was set. Page inspection recorded consent-management globals for TCF, GPP and USP APIs, tracker requests served by Clarity and Microsoft advertising code, and a document hash of 099132126957 for campaign pivoting.

Infraestructura

Weaknesses first: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP were all absent, and DNSSEC was unsigned. TLS 1.3 with AES-128-GCM; SPF present with no DKIM or DMARC; CAA present. No registrar data was recorded, hosting was recorded on the Confluence Networks Inc network on 2026-10-02 with Cowboy and openresty server headers, and the hostname carried a CNAME to a third-party search platform.

What to do

If you entered credentials or personal data on the captured page, change that password on the genuine service and enable two-factor authentication, then watch the account for unexpected activity. For defenders, block ww19.palcamps.net at the DNS or proxy layer, hunt for prior visits to it, and treat the PhishDestroy internal listing from 2026-10-26 as the operative signal despite negative external feeds.

Enlaces útiles

urlscan.io scan and screenshot Informe de Cloudflare Radar Stored capture screenshot Cloudflare Radar screenshot (2026-10-25T15:12:47Z)Informe de VirusTotal Google Safe Browsing status Archived copy Report phishing to Google Site owner? Request a review

Evidencias de las fuentesVirusTotal 0 / 92 8 fuentes

URLScan

Malicioso · veredicto de los motores · puntuación 35

SHA-256 860150cec57c9c16dba876a7f418e2b3fc2b3467931cb33a598b294d346b50ef

2026-10-02 09:12 UTC

Abrir informe

URLScanRegistro original de la fuenteObservado: 2026-10-02 09:12:14 UTC21 campos

Observado: 2026-10-02T09:12:14Z · Consultado el: 2026-10-25T15:11:09Z

ID del informe

01a0fbe2-8e85-7598-878a-9a0c412b6dd1

URL final

http://ww19.palcamps.net/

Respuesta HTTP

200

Tipo de redirección

parent-domain

Redirecciones

Hacia
https://palcamps.net/
Desde
https://palcamps.net/
Hacia
http://ww19.palcamps.net/
Desde
https://palcamps.net/
Estado
302
Hacia
https://ww19.palcamps.net/
Desde
http://ww19.palcamps.net/
Estado
307
Hacia
http://ww19.palcamps.net/
Desde
https://ww19.palcamps.net/
Estado
307

Dirección IP

208.91.196.145

Dominios contactados

l.cdn-fileserver.com
cdn.consentmanager.net
d.delivery.consentmanager.net
s.cdn-fileserver.com
palcamps.net
s.yimg.com
msadsscale.microsoft.com
scripts.clarity.ms
searchresultsworld.com

Direcciones IP con las que se ha establecido contacto

188.114.96.3
87.248.119.252
150.171.109.106
150.171.109.194
104.21.26.182
195.181.175.40
85.9.206.5
188.114.97.3
208.91.196.145
37.48.72.213

Sistemas autónomos (ASN)

13335
203220
8075
60068
202053
40034
60781

Países de los servidores

Dominios vinculados

findsearchresults.com
skenzo.com

Hash del documento

09913212695747b9984fb556d839d04466efe629212c36c26af5bcce18f05327

Variables globales de JavaScript

cmp_id
cmp_cdid
cmp_params
cmp_host
cmp_cdn
cmp_proto
cmp_codesrc
cmp_getsupportedLangs
cmp_getRTLLangs
cmp_getlang
cmp_addFrame
cmp_rc
cmp_stub
cmp_gpp_ping
cmp_gppstub
cmp_msghandler
cmp_setStub
cmp_setGppStub
__cmp
__tcfapi
__uspapi
__gpp
olaSyncCount
__bdata
checkDNS
cmp_utillities
cmp_gppmanifest
cmp_fibo
cmp_reader
cmp_writer
cmp_cs
cmp_lang
cmp_purpose
cmp_feature
cmp_stack
cmp_vendor
cmp_snapshot
cmp_storage
cmp_gpp_helper
cmp_api

Cookies

sid
__cmpcc
__cmpconsentx175795
__cmpcccx175795

Claves de almacenamiento del navegador

cmp_gpcConsentModeEligible.40679ccc92462
__cmpconsentx175795_ww19.palcamps.net
__cmpconsentx175795_expire_ww19.palcamps.net
__cmpcccx175795_ww19.palcamps.net
__cmpcccx175795_expire_ww19.palcamps.net

Sesión TLS y certificado

Nombres alternativos del sujeto (SAN): example.com
Conjunto de cifrado: AES_128_GCM
Emisor: example.com
Sujeto: example.com
Protocolo: TLS 1.3
Válido hasta: 2036-03-18 04:15:51 UTC
Válido desde: 2026-03-21 04:15:51 UTC

Antigüedad del dominio, días

Antigüedad del dominio registrado, días

3015

Solicitudes de la página

Veredictos de los proveedores

Veredicto de los motores

Etiquetas: urlscan-ml
urlscan-ml-60c5e22
Puntuación: 35
Malicioso: Sí

Veredicto general

Puntuación: 0
Malicioso: No

Encabezados HTTP

Servidor: Cowboy
Content-type: text/html; charset=utf-8

Campos originales de la fuente · JSON

Uuid	01a0fbe2-8e85-7598-878a-9a0c412b6dd1
Final url	http://ww19.palcamps.net/
Estado	200
Redirigido	parent-domain
Redirecciones	[ { "to": "https://palcamps.net/", "from": "https://palcamps.net/" }, { "to": "http://ww19.palcamps.net/", "from": "https://palcamps.net/", "status": 302 }, { "to": "https://ww19.palcamps.net/", "from": "http://ww19.palcamps.net/", "status": 307 }, { "to": "http://ww19.palcamps.net/", "from": "https://ww19.palcamps.net/", "status": 307 } ]
Ip	208.91.196.145
Dominios contactados	[ "l.cdn-fileserver.com", "cdn.consentmanager.net", "d.delivery.consentmanager.net", "s.cdn-fileserver.com", "palcamps.net", "s.yimg.com", "msadsscale.microsoft.com", "scripts.clarity.ms", "searchresultsworld.com" ]
Direcciones IP con las que se ha establecido contacto	[ "188.114.96.3", "87.248.119.252", "150.171.109.106", "150.171.109.194", "104.21.26.182", "195.181.175.40", "85.9.206.5", "188.114.97.3", "208.91.196.145", "37.48.72.213" ]
Asns	[ "13335", "203220", "8075", "60068", "202053", "40034", "60781" ]
Countries	[ "GB", "US", "DE", "VG", "NL" ]
Dominios vinculados	[ "findsearchresults.com", "skenzo.com" ]
Hash del documento	09913212695747b9984fb556d839d04466efe629212c36c26af5bcce18f05327
Globals	[ "cmp_id", "cmp_cdid", "cmp_params", "cmp_host", "cmp_cdn", "cmp_proto", "cmp_codesrc", "cmp_getsupportedLangs", "cmp_getRTLLangs", "cmp_getlang", "cmp_addFrame", "cmp_rc", "cmp_stub", "cmp_gpp_ping", "cmp_gppstub", "cmp_msghandler", "cmp_setStub", "cmp_setGppStub", "__cmp", "__tcfapi", "__uspapi", "__gpp", "olaSyncCount", "__bdata", "checkDNS", "cmp_utillities", "cmp_gppmanifest", "cmp_fibo", "cmp_reader", "cmp_writer", "cmp_cs", "cmp_lang", "cmp_purpose", "cmp_feature", "cmp_stack", "cmp_vendor", "cmp_snapshot", "cmp_storage", "cmp_gpp_helper", "cmp_api" ]
Cookies	[ "sid", "__cmpcc", "__cmpconsentx175795", "__cmpcccx175795" ]
Storage keys	[ "cmp_gpcConsentModeEligible.40679ccc92462", "__cmpconsentx175795_ww19.palcamps.net", "__cmpconsentx175795_expire_ww19.palcamps.net", "__cmpcccx175795_ww19.palcamps.net", "__cmpcccx175795_expire_ww19.palcamps.net" ]
Tls	{ "san": [ "example.com" ], "cipher": "AES_128_GCM", "issuer": "example.com", "subject": "example.com", "protocol": "TLS 1.3", "valid_to": "2036-03-18T04:15:51Z", "valid_from": "2026-03-21T04:15:51Z" }
Antigüedad del dominio en días	0
Apex age days	3015
Solicitudes	23
Veredictos de los proveedores	{ "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 35, "malicious": true }, "overall": { "score": 0, "malicious": false } }
Encabezados HTTP	{ "server": "Cowboy", "content-type": "text/html; charset=utf-8" }

VirusTotal

0 / 92 detecciones del motor · resumen guardado

2026-10-25 15:43 UTC

Abrir informe

VirusTotalRegistro original de la fuenteObservado: 2026-10-25 15:22:29 UTC11 campos

Observado: 2026-10-25T15:22:29Z · Consultado el: 2026-10-25T15:43:30Z

Recuento de resultados de proveedores

Tiempo agotado: 0
Inofensivo: 55
Malicioso: 0
Sospechoso: 0
No detectado: 37

Puntuación de reputación

Registrador

Launchpad.com Inc.

Creado

2015-08-20 20:40:10 UTC

Caduca

2027-08-20 20:40:10 UTC

Actualizado

2026-10-02 02:17:37 UTC

Visto por primera vez

2026-10-20 08:06:42 UTC

Registros DNS

TTL, segundos
889
Tipo
NS
Valor
ns2.cnomy.com
TTL, segundos
889
Tipo
NS
Valor
ns1.cnomy.com
TTL, segundos
300
Tipo
SOA
Buzón del responsable
abuse.confluence-networks.com
Valor
ns1.cnomy.com
TTL, segundos
300
Tipo
TXT
Valor
v=spf1 a -all
TTL, segundos
300
Tipo
MX
Valor
~
Prioridad
300
TTL, segundos
900
Tipo
A
Valor
208.91.196.145
TTL, segundos
300
Tipo
CNAME
Valor
9145.searchmagnified.com

Registros DNS obtenidos

2026-10-25 15:28:27 UTC

Certificado

Nombres alternativos del sujeto (SAN): ww19.palcamps.net
Emisor: ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2
Número de serie: 1f28e9d35ba3040919dbca735b57cf63
SHA-256: 27c2df594f41e4c6ff269c44001ea5dfbcb41c182a26b3e6c316e06405d45c3d
Sujeto: ww19.palcamps.net
Válido hasta: 2027-01-08 23:59:59 UTC
Válido desde: 2026-10-10 00:00:00 UTC

Ficha de registro

Registrador: Launchpad.com Inc.
ID de IANA del registrador: 955
URL del registrador: http://www.launchpad.com
Registrado: 2015-08-20 20:40:10 UTC
Actualizado: 2026-09-25 21:26:33 UTC
Caduca: 2027-08-20 20:40:10 UTC
Estado: clientTransferProhibited
Servidores de nombres: ns1.brainydns.com
ns2.brainydns.com
DNSSEC: unsigned

Campos originales de la fuente · JSON

Recuento de resultados de proveedores	{ "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }
Reputación	0
Registrador	Launchpad.com Inc.
Creado	2015-08-20T20:40:10Z
Caduca	2027-08-20T20:40:10Z
Actualizado	2026-10-02T02:17:37Z
Visto por primera vez	2026-10-20T08:06:42Z
Registros DNS	[ { "ttl": 889, "type": "NS", "value": "ns2.cnomy.com" }, { "ttl": 889, "type": "NS", "value": "ns1.cnomy.com" }, { "ttl": 300, "type": "SOA", "rname": "abuse.confluence-networks.com", "value": "ns1.cnomy.com" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 a -all" }, { "ttl": 300, "type": "MX", "value": "~", "priority": 300 }, { "ttl": 900, "type": "A", "value": "208.91.196.145" }, { "ttl": 300, "type": "CNAME", "value": "9145.searchmagnified.com" } ]
Dns at	2026-10-25T15:28:27Z
Certificado	{ "san": [ "ww19.palcamps.net" ], "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2", "serial": "1f28e9d35ba3040919dbca735b57cf63", "sha256": "27c2df594f41e4c6ff269c44001ea5dfbcb41c182a26b3e6c316e06405d45c3d", "subject": "ww19.palcamps.net", "valid_to": "2027-01-08T23:59:59Z", "valid_from": "2026-10-10T00:00:00Z" }
Ficha de registro	{ "registrar": "Launchpad.com Inc.", "registrar_iana_id": "955", "registrar_url": "http://www.launchpad.com", "created": "2015-08-20T20:40:10Z", "updated": "2026-09-25T21:26:33Z", "expires": "2027-08-20T20:40:10Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1.brainydns.com", "ns2.brainydns.com" ], "dnssec": "unsigned" }

Registro de origen independiente · 0 malicious + 0 suspicious / 92 · 2026-10-25 15:22:29 UTC

El resumen anterior y este registro del proveedor se recopilaron en momentos diferentes. Ambos siguen estando disponibles; las clasificaciones como «malicioso» y «sospechoso» se muestran por separado.

record_source: collected_observations.vt
analysis_at: 2026-10-25T15:22:29Z
fetched_at: 2026-10-25T15:43:30Z
stats: {"timeout":0,"harmless":55,"malicious":0,"suspicious":0,"undetected":37}

OTX

sin referencias de la comunidad

2026-10-25 15:44 UTC

Abrir informe

Cloudflare Radar

provider verdict: clean

Abrir informe

Cloudflare RadarRegistro original de la fuenteObservado: 2026-10-25 15:12:47 UTC11 campos

Observado: 2026-10-25T15:12:47Z · Consultado el: 2026-10-25T15:13:44Z

ID del informe

dae5e046-3ef4-4ceb-ae22-00ad53d63fcf