Keamanan domain dan intelijen ancaman

ewcdsihojsa.com

Name: ewcdsihojsa.com — PhishDestroy evidence record
Published: 2026-10-26
License: https://creativecommons.org/licenses/by/4.0/

Ringkasnya

ewcdsihojsa.com: Phishing, terdeteksi oleh PhishDestroy pada 2026-10-26.

Tinjau bukti

Registrar: NameCheap
Resolved IP: 188.114.96.1
Terdaftar: 01/07/2026

Penilaian PhishDestroy Kritis

95/100

Skor bukti

Pertama kali teramati Oct 26, 2026 00:25 UTC · PhishDestroy

Sinyal risiko

Deteksi Total Virus: 15/92

VirusTotal

15 / 92

deteksi mesin · 2026-10-26

OTX

referensi komunitas

Cloudflare Radar

—

Tidak tercatat

Tangkapan halaman

buka galeri

Usia domain

116 days

Laporan terkirim

—

Tidak ada catatan yang terkirim

Ringkasan laporan

Phishing: ewcdsihojsa.com — Belum terverifikasi. Ringkasan bukti: VirusTotal 15/92 (alphaMountain.ai, BitDefender, Chong Lua Dao, DNS8, ESET); URLScan…

Analisis terperinci PhishDestroy AI di bawah tetap berbahasa Inggris untuk menjaga catatan forensik asli.

Analisis

Laporan Ancaman PhishDestroy2026-10-26 00:38:58 UTC

Overview

PhishDestroy added ewcdsihojsa.com to its internal blocklist on 2026-10-26 based on vendor detections. The domain was first observed by PhishDestroy on 2026-10-26. A urlscan.io capture on 2026-09-04 returned HTTP 503 Service Unavailable. A Cloudflare Radar scan on 2026-10-26 returned HTTP 522.

How the scam works

The listing reflects multiple vendor detections but does not establish a specific scam mechanism. Such domains are often associated with malware distribution or domain-generation activity, yet the current evidence only shows error responses, so the exact risk remains undetermined.

Bukti

VirusTotal analysis on 2026-10-19 reported 12 malicious and 3 suspicious detections out of 92 engines and tagged the domain as phishing/DGA. Google Safe Browsing checked on 2026-10-26 returned no flag. urlscan.io captured the site on 2026-09-04; its ML engine scored 81 malicious while the overall verdict was clean. Cloudflare Radar scan on 2026-10-26 returned a malicious verdict with categories malware and DGA domains. OTX listed one pulse as of 2026-10-26. PhishDestroy’s internal blocklist includes the domain as of 2026-10-26; external blocklists reported none.

Infrastruktur

The domain was registered with NameCheap on 2026-07-01 for one year. Historical DNS records show A records 188.114.96.0 and 188.114.97.0 and AAAA records 2a06:98c1:3120:: and 2a06:98c1:3121::, served via Cloudflare nameservers. TLS was issued by Google Trust Services, valid from 2026-08-29 to 2026-11-27, with SANs for the domain and a wildcard. DNSSEC was not enabled.

What to do

Do not enter credentials or download files from ewcdsihojsa.com. If you have already submitted login information, change those passwords and enable two-factor authentication. Add the domain to web-filter block lists and monitor network logs for connections to its historical IP ranges. Security teams should flag any traffic to the recorded addresses or IPv6 ranges.

Tautan yang berguna

urlscan.io scan and screenshot Laporan Cloudflare Radar Stored capture screenshot Cloudflare Radar screenshot (2026-10-26T00:33:33Z)URLScan screenshot (2026-07-29T09:54:55Z)URLScan capture report URLScan screenshot (2026-10-26T00:27:36Z)URLScan capture report URLScan screenshot (2026-10-26T00:34:31Z)URLScan capture report Laporan VirusTotal Google Safe Browsing status Report phishing to Google Site owner? Request a review

Bukti sumberVirusTotal 15 / 92 · OTX 1 references 7 sources

VirusTotal

15 / 92 deteksi mesin · ringkasan yang tersimpan

2026-10-26 00:32 UTC

Buka laporan

VirusTotalCatatan asli sumberTeramati: 2026-10-19 17:51:33 UTC16 kolom

Teramati: 2026-10-19T17:51:33Z · Diambil: 2026-10-26T00:32:02Z

Jumlah hasil vendor

Waktu habis: 0
Tidak berbahaya: 46
Berbahaya: 12
Mencurigakan: 3
Tidak terdeteksi: 31

Label pemasok

DNS8: suspicious
ESET: suspicious
VIPRE: phishing
G-Data: phishing
Lionic: phishing
Sophos: phishing
Webroot: malicious
Fortinet: phishing
SOCRadar: phishing
Kaspersky: phishing
Gridinsoft: suspicious
BitDefender: phishing
Chong Lua Dao: malicious
alphaMountain.ai: phishing
Forcepoint ThreatSeeker: phishing

Skor reputasi

Kategori

Sophos: phishing and fraud
Webroot: Phishing and Other Frauds
alphaMountain.ai: Phishing (alphaMountain.ai)

Registrar

NAMECHEAP INC

Dibuat

2026-07-01 04:03:03 UTC

Berlaku hingga

2027-07-01 04:03:03 UTC

Diperbarui

2026-07-01 04:04:01 UTC

Pertama terlihat

2026-07-01 04:31:52 UTC

Catatan DNS

TTL, detik
1800
Jenis
SOA
Alamat penanggung jawab
dns.cloudflare.com
Nilai
marjory.ns.cloudflare.com
TTL, detik
300
Jenis
A
Nilai
172.67.135.210
TTL, detik
300
Jenis
AAAA
Nilai
2606:4700:3035::ac43:87d2
TTL, detik
300
Jenis
AAAA
Nilai
2606:4700:3037::6815:1a5c
TTL, detik
21600
Jenis
NS
Nilai
ray.ns.cloudflare.com
TTL, detik
300
Jenis
A
Nilai
104.21.26.92
TTL, detik
21600
Jenis
NS
Nilai
marjory.ns.cloudflare.com

Waktu pengambilan catatan DNS

2026-10-19 17:57:08 UTC

Sidik jari JARM

27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c

Sertifikat

Nama alternatif subjek (SAN): ewcdsihojsa.com
*.ewcdsihojsa.com
Penerbit: Google Trust Services / WE1
Nomor seri: 897efc97477124b61312f89b25a2a979
SHA-256: 408a18f7c87dcaac1a7b5666635f41fb87e6d7400f4d95e323e435fa43adb88d
Subjek: ewcdsihojsa.com
Berlaku hingga: 2026-11-27 13:41:53 UTC
Berlaku sejak: 2026-08-29 12:42:03 UTC

Catatan pendaftaran

Registrar: NAMECHEAP INC
ID IANA registrar: 1068
URL registrar: http://www.namecheap.com
Terdaftar: 2026-07-01 04:03:03 UTC
Diperbarui: 1-01-01T00:00:00Z
Berlaku hingga: 2027-07-01 04:03:03 UTC
Status: clientTransferProhibited
Server nama: marjory.ns.cloudflare.com
ray.ns.cloudflare.com
DNSSEC: unsigned

Data registri (RDAP)

Status

client transfer prohibited

Peristiwa registri

Pendaftaran: 2026-07-01 04:03:03 UTC
Berakhir di registrar: 2027-07-01 04:03:03 UTC
Pembaruan terakhir basis data RDAP: 2026-10-18 17:51:43 UTC

Kolom asli sumber · JSON

Jumlah hasil vendor	{ "timeout": 0, "harmless": 46, "malicious": 12, "suspicious": 3, "undetected": 31 }
Label pemasok	{ "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }
Reputasi	0
Tag	[ "dga" ]
Kategori	{ "Sophos": "phishing and fraud", "Webroot": "Phishing and Other Frauds", "alphaMountain.ai": "Phishing (alphaMountain.ai)" }
Registrar	NAMECHEAP INC
Dibuat	2026-07-01T04:03:03Z
Berlaku hingga	2027-07-01T04:03:03Z
Diperbarui	2026-07-01T04:04:01Z
Pertama terlihat	2026-07-01T04:31:52Z
Catatan DNS	[ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "marjory.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.135.210" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::ac43:87d2" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:1a5c" }, { "ttl": 21600, "type": "NS", "value": "ray.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.26.92" }, { "ttl": 21600, "type": "NS", "value": "marjory.ns.cloudflare.com" } ]
Dns at	2026-10-19T17:57:08Z
Jarm	27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c
Sertifikat	{ "san": [ "ewcdsihojsa.com", "*.ewcdsihojsa.com" ], "issuer": "Google Trust Services / WE1", "serial": "897efc97477124b61312f89b25a2a979", "sha256": "408a18f7c87dcaac1a7b5666635f41fb87e6d7400f4d95e323e435fa43adb88d", "subject": "ewcdsihojsa.com", "valid_to": "2026-11-27T13:41:53Z", "valid_from": "2026-08-29T12:42:03Z" }
Catatan pendaftaran	{ "registrar": "NAMECHEAP INC", "registrar_iana_id": "1068", "registrar_url": "http://www.namecheap.com", "created": "2026-07-01T04:03:03Z", "updated": "1-01-01T00:00:00Z", "expires": "2027-07-01T04:03:03Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "marjory.ns.cloudflare.com", "ray.ns.cloudflare.com" ], "dnssec": "unsigned" }
Data registri	{ "status": [ "client transfer prohibited" ], "events": { "registration": "2026-07-01T04:03:03Z", "registrar expiration": "2027-07-01T04:03:03Z", "last update of RDAP database": "2026-10-18T17:51:43Z" } }

Catatan sumber terpisah · 12 malicious + 3 suspicious / 92 · 2026-10-19 17:51:33 UTC

Ringkasan di atas dan catatan penyedia ini dikumpulkan pada waktu yang berbeda. Keduanya tetap tersedia; klasifikasi berbahaya dan mencurigakan ditampilkan secara terpisah.

record_source: collected_observations.vt
analysis_at: 2026-10-19T17:51:33Z
fetched_at: 2026-10-26T00:32:02Z
stats: {"timeout":0,"harmless":46,"malicious":12,"suspicious":3,"undetected":31}

URLScan

Berbahaya · putusan mesin · skor 81

2026-09-04 10:23 UTC

Buka laporan

URLScanCatatan asli sumberTeramati: 2026-09-04 10:23:33 UTC15 kolom

Teramati: 2026-09-04T10:23:33Z · Diambil: 2026-10-26T00:37:56Z

ID laporan

01a06bf1-da9d-722d-b8b5-f5c80b911ffa

URL Akhir

https://ewcdsihojsa.com/

Respons HTTP

503

Alamat IP

188.114.97.3

Alamat IP yang dihubungi

188.114.97.3

Sistem otonom (ASN)

13335

Hash dokumen

6447a2882c4f20346b7b0f041d50d090d7c9aed4620dae267b56456686b11b3d

Sesi TLS dan sertifikat

Nama alternatif subjek (SAN): ewcdsihojsa.com
*.ewcdsihojsa.com
Cipher suite: AES_128_GCM
Penerbit: WE1
Subjek: ewcdsihojsa.com
Protokol: QUIC
Berlaku hingga: 2026-11-27 13:41:53 UTC
Berlaku sejak: 2026-08-29 12:42:03 UTC

Usia domain, hari

Usia domain terdaftar, hari

Usia sertifikat, hari

Masa berlaku sertifikat, hari

Permintaan halaman

Keputusan penyedia layanan

Putusan mesin

Tag: urlscan-ml
urlscan-ml-60c5e22
Skor: 81
Berbahaya: Ya

Putusan keseluruhan

Skor: 0
Berbahaya: Tidak

Header HTTP

Server: cloudflare
Content-type: text/html; charset=utf-8

Kolom asli sumber · JSON

Uuid	01a06bf1-da9d-722d-b8b5-f5c80b911ffa
Final url	https://ewcdsihojsa.com/
Status	503
Ip	188.114.97.3
Alamat IP yang dihubungi	[ "188.114.97.3" ]
Asns	[ "13335" ]
Hash dokumen	6447a2882c4f20346b7b0f041d50d090d7c9aed4620dae267b56456686b11b3d
Tls	{ "san": [ "ewcdsihojsa.com", "*.ewcdsihojsa.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "ewcdsihojsa.com", "protocol": "QUIC", "valid_to": "2026-11-27T13:41:53Z", "valid_from": "2026-08-29T12:42:03Z" }
Usia domain (hari)	65
Apex age days	65
Tls age days	5
Masa berlaku TLS (hari)	90
Permintaan	2
Keputusan penyedia layanan	{ "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 81, "malicious": true }, "overall": { "score": 0, "malicious": false } }
Header HTTP	{ "server": "cloudflare", "content-type": "text/html; charset=utf-8" }

Catatan monitor terpisah · tanggal tidak tercatat

Cuplikan monitor yang disimpan secara terpisah; tidak menggantikan catatan laporan utama atau menentukan ketersediaan saat ini.

record_source: domain_monitor.urlscan
uuid: 01a06bf1-da9d-722d-b8b5-f5c80b911ffa
report_url: https://urlscan.io/result/01a06bf1-da9d-722d-b8b5-f5c80b911ffa/
skor: null
malicious: null
result_at: null
enriched_at: null
source_timestamps: {"urlscan_result_at":null,"urlscan_enriched_at":null}
timestamp_basis: Eropa/Berlin, sebagaimana digunakan dalam laporan yang ada; cap waktu sumber dipertahankan apa adanya

OTX

1 community reference

2026-10-26 00:34 UTC

Buka laporan

Cloudflare Radar

Laporan pemindaian

Tidak tercatat

Buka laporan

Cloudflare RadarCatatan asli sumberTeramati: 2026-10-26 00:33:33 UTC13 kolom

Teramati: 2026-10-26T00:33:33Z · Diambil: 2026-10-26T00:37:57Z

ID laporan

d4698df2-afd9-4c4b-b0cc-8b24a49f905a

URL Akhir

https://ewcdsihojsa.com/

Respons HTTP

522

Riwayat navigasi

URL
https://ewcdsihojsa.com/
Status
522

Hash struktur DOM

44f83b86670a53701e60f71195a3f41260783e3e1297f0ec6a48f6f4d16a372e

Hash dokumen

a0068d6b56c48f65885e5c97b88ca29aeadd067e3d47a2498a52fc25ce33100e

Kategori risiko domain

Malware
Security threats
DGA Domains
CIPA Filter
CIPA