dl.africanhistory.online is a link subdomain on a history-themed domain that PhishDestroy classifies as an impersonation phishing page. We first flagged it on 2026-07-27. As of 2026-10-19 the site is still alive and answers with a redirect, so a visitor who clicks a link to it is sent somewhere else. Its targets are people who receive the link in messages, posts or emails and trust where it appears to lead.
How the scam works
Impersonation pages borrow the look or name of a trusted service so that visitors hand over logins, personal details or payments without suspicion. A 'dl.' subdomain used as a redirect hop lets operators share one neutral-looking link and change the final destination whenever they like. The page title currently reads 'Invalid Dynamic Link', a generic link-service error, while our classification is impersonation phishing. Whatever page the redirect delivers, the risk is the same: anything typed into a form reached this way should be treated as handed to the operator.
Evidence
Independent detection is thin. On 2026-09-14, 4 of 89 VirusTotal engines flagged the address: alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. PhishDestroy is the only blocklist currently listing it. Most browsers and filters will therefore let it through without a warning, so a clean browser result is not proof the link is safe.
Infrastructure
The parent domain was registered through NameCheap, Inc. on 2023-05-04, roughly three years before we detected the subdomain. An older domain with an unremarkable theme draws less suspicion than a freshly registered lookalike. The site is served from Fastly, Inc. infrastructure in the US, and its certificate comes from Google Trust Services (WR3). That makes the browser padlock a sign of encryption only, not of who runs the page.
What to do
If you followed this link, check where it landed you and do not continue on that page. If you entered a password there, change it immediately and turn on two-factor authentication, starting with any account that shares the same password. If you shared card, banking or identity details, contact your bank or provider and watch for follow-up phishing that uses what you gave. Defenders should block the full subdomain and its parent at DNS, proxy and email gateways. They should also search logs for recent clicks and treat redirect hops like this one as suspicious, even when they carry error-style titles.
For the registrable domain africanhistory.online behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Accountability draft
कुछ भी अपने आप नहीं भेजा जाता।
Network & certificates
Stored technical evidence
Network & DNS
Shared CDN edge
Resolved IP
199.36.158.100
Network ASN
AS54113
Organization
Google LLC
Observed location
Mountain View, US
Server header
Varnish
एज-आईपी प्रतिष्ठा इस डोमेन के लिए जिम्मेदार नहीं है।
नेमसर्वर 1
dns2.registrar-servers.com
Mail routing 2 MX records
mx1.privateemail.compriority 10
mx2.privateemail.compriority 10
Location describes the IP network.
TLS प्रमाणपत्र
Issuer
Google Trust Services
Valid from
2026-07-24 02:09:20
Valid until
2026-10-22 03:06:27
Hostname coverage
Certificate hostname mismatch
Validity
Within stored validity dates
Collection time
2026-08-13 07:02:25 UTC
Collection source
PhishDestroy collector
Certificate fingerprint898599411086227808415281f7493496b6899aa45905b089530b61e8e5a48c43Certificate names · 99 SANs
2alan.com
admin.enzomechana.com
amr.ikanamedia.com
andreasorrentino.com
app.ekselio.tech
app.jeff.fitness
app.lider.cl
app.partnurse.kro.kr
app.puur-eva.be
auth.redskymarkets.com
authentication-singapore.com
babydovesdaycare.com
beenalone.com
bodariveravalle.swanmoments.com
boratltd.com
btstg.com
chargelity.pl
crm.trick17.it
cuneiform.hittites.org
dev-events.habitatnycwc.org
dev.domspace.net
dev.widgets.vezham.com
dynurl.swissunihockey.ch
elevatortechonline.com
fili.hibudgeting.com
gosiak.dev
hewapatha.com
img.hkdma.com.hk
india-pin.in
insta.eceinel.dev
junjiewei.com
kaching.boldgames.io
karaoke.garrettmanley.com
kauche.dev
keighly.ca
learn.1stclasslax.com
links.haloedapp.com
manadplyus.com
mastereye.in
matthewbacon.com
meetings.kiehnlein.com
members.capricornbusinesshub.au
my.updateeveryone.com
narlideredis.com
ninjaswarriors.com
pantrify.gartorware.com
pierredaviau.com
pigsub.com
pl.cotuongoffline.com
possiblefutures.io
premiumcameras.yanek-k.com
prevalentstudiorentals.com
projectflow.global
quest.ng-conf.com
quiz.scrumcorp.de
ramakrishnan.dev
rekat.in
riptech.solutions
rpwebconsulting.com
savethedaterosaleslopez.swanmoments.com
scalenda.com
shirleys-estate.com
shrusoft.com
sieciitm.com
sistemasaudiovisualestijuana.com
smscapa.com
tanklytics.com
thecruciball.com
tower-slider.play.funfactive.com
ujsser.org
utags.co
warner.click
www.beavercreekmfg.ca
www.blockstarlogic.xyz
www.bookstack.co
www.bort.cl
www.chinchoo.xyz
www.cosmicstudios.co.in
www.darcydevelopment.com
www.db-soft.be
www.frigo-online.com
www.goatorthroat.com
www.happymatches.com
www.houseofachilleos.co.uk
www.kidskey.ru
www.letguiltgo.com
www.libres-ensemble.fr
www.lonegrovedental.com
www.machite.com
www.mindfulflights.com
www.noorulislamacademy.com
www.noterightnow.com
www.nutriologataniaflores.com
www.oz.campbelldancers.com
www.perfectlyhappy.com
www.red-pot-studio.com
www.salvageunionworkshop.com
www.studioballon.it
www.thoughtcrafters.com
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Latest HTTP observationRedirectingHTTP redirect observed80%2026-10-20 10:07:42 UTC
RDAP registrationअज्ञात
Observed timelinelast reachable: 2026-10-20 10:07:42 UTClast content: 2026-10-18 10:07:38 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
तकनीकें · 2 identified
F
Firebase
DatabasesDevelopment
Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.
संग्रहीत संबंधों को सटीक मिलान विशेषता द्वारा समूहीकृत किया जाता है। एक साझा प्रदाता या रजिस्ट्रार अकेले सामान्य स्वामित्व साबित नहीं करता है।
संरचना मानचित्र · dl.africanhistory.online
प्रत्येक लेन एक कारण है कि कोई डोमेन इस होस्ट से जुड़ा हुआ है। नोड का आकार ईVirusTotal का संकेत देता है और धराशायी नोड पहले से ही ऑफ़लाइन हैं। पूरी सूचियाँ नीचे दी गई हैं।
सामग्री मेल खाती है4
इस होस्ट की तरह वही फ़ैविकॉन हैश या वही पेज शीर्षक।
एक ही रजिस्ट्रार के माध्यम से पंजीकृत। एक रजिस्ट्रार लाखों असंबंधित ग्राहकों को सेवा प्रदान करता है, इसलिए यह लिंक साबित करने के बजाय रिपोर्टों को समूहित करता है।
3 evidence signal groups linked0 stored notification recordsअंतिम ज्ञात सक्रिय
Listed domains receive at least one abuse report; this entry has no retained notification history.
If credentials were compromised, report immediately. Do not engage with recovery scammers.
यदि आपने खाता क्रेडेंशियल, व्यक्तिगत या भुगतान जानकारी दर्ज की है, या इस डोमेन से कोई फ़ाइल डाउनलोड की है, तो तुरंत कार्रवाई करें। घटना की रिपोर्ट करने और अपनी सुरक्षा करने में आपकी सहायता के लिए नीचे संसाधन दिए गए हैं।
रिकवरी ठगों से सावधान रहें! अपराधी जांचकर्ता, वकील या रिकवरी एजेंट होने का नाटक करते हुए पीड़ितों से दोबारा संपर्क कर सकते हैं। अग्रिम शुल्क का भुगतान न करें या क्रेडेंशियल साझा न करें।रिकवरी धोखाधड़ी के बारे में और जानें →
Template-based draft · optional AI wording assistance requires separate consent
एआई-सहायता प्राप्त ड्राफ्ट - घटना विवरण एआई प्रदाता द्वारा संसाधित किया जाता है · इसकी स्वयं समीक्षा करें और सबमिट करें
After a phishing incident
पीड़ितों के लिए सिफारिशें और सलाह
Choose the steps that match what you shared. Keep a copy of this report alongside your own records.
मुझे तुरंत क्या करना चाहिए?
अत्यावश्यक
Stop using the suspicious site. Open the real service through its official app or an address you already trust.
सभी पासवर्ड बदलें — ईमेल, एक्सचेंज खाते, कुछ भी जो एक ही पासवर्ड साझा करता हो
2FA सक्षम करें एक ऑथेंटिकेटर ऐप (एसएमएस नहीं) का उपयोग करें। एसएमएस-आधारित रिकवरी को अक्षम करें।
फ्रीज़ कार्ड्स यदि आपने फिशिंग साइट पर बैंकिंग विवरण दर्ज किए
मैं अपनी रिपोर्ट के लिए कौन सी जानकारी एकत्र करूँ?
एफबीआई दिशानिर्देश
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
सटीक तिथियाँ और समय — प्रत्येक लेनदेन और ठग के साथ पहली बातचीत का
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
स्थानीय पुलिस — एक आधिकारिक रिकॉर्ड बनाता है, भले ही वे तुरंत कार्रवाई न कर सकें
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
How do phishing scams typically work?
नकली वेबसाइटें — थोड़े बदले हुए डोमेन के साथ वैध साइटों के पिक्सेल-परफेक्ट क्लोन
सूअर का वध — टेलीग्राम/व्हाट्सएप/डेटिंग ऐप्स के माध्यम से हफ्तों में बनाया गया भरोसा, फिर पैसे चोरी
रिकवरी घोटाले — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
एआई-संचालित धोखाधड़ियाँ — डीपफेक, स्वचालित फ़िशिंग, और एआई-जनित साइटें धोखाधड़ी का पता लगाना कठिन बना रही हैं
मैं भविष्य में खुद को कैसे सुरक्षित रख सकता हूँ?
आधिकारिक साइटों को बुकमार्क करें — ईमेल, डीएम, या विज्ञापनों में दिए गए लिंक पर कभी क्लिक न करें
डोमेन सत्यापित करें — की जाँच करें PhishDestroy संवाद करने से पहले HTTPS, वर्तनी, डोमेन की आयु की जाँच करें।
"सच होने के लिए बहुत अच्छा" = घोटाला — गारंटीशुदा रिटर्न, सेलिब्रिटी समर्थन, तत्काल समय-सीमाएँ
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
