ABUSE NOTICE · 7D+ OPEN
Outgoing abuse reports are recorded; the latest stored availability evidence still shows the domain reachable.
Notification and current-status evidence
The sent-report ledger records the first outgoing report at .
The recorded recipient is abuse@vps.ua.
The latest stored availability evidence still shows the domain reachable; 9 days has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations.
This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
promo.parik24.expert is a live site on the PhishDestroy blocklist that presents itself under the page title "Parik24", placing a promotional subdomain under a brand-like name on an expert domain. PhishDestroy first saw it on 2026-10-13. When last checked on 2026-10-19, the site was still up and serving content. Anyone who reaches it through an ad, message or bonus offer should treat it as hostile.
How the scam works
The page carries the Parik24 name and sits on a "promo" subdomain. That combination is commonly used to draw visitors in with an offer and then ask them to log in, register, or make a payment. PhishDestroy has not yet assigned this domain a specific scheme type. However, the Spamhaus phishing listing and the vendor detections point to a page built to capture account credentials, personal details or payment information from people who believe they are dealing with Parik24. Anything typed into such a page should be considered exposed to the operators.
Evidence
Twelve of 92 VirusTotal engines flagged the domain as of 2026-10-17. The flagging vendors include alphaMountain.ai, BitDefender, CRDF, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data and Kaspersky. That is a modest ratio, but the list includes several major independent security vendors, so the flag is not a single outlier. Spamhaus lists the domain in its DBL under the phishing category, which reinforces those detections. PhishDestroy carries it on its own blocklist.
Infrastructure
The domain was registered on 2026-09-24 through WEDOS Internet, a.s., just 19 days before PhishDestroy detected it. That short gap is typical of throwaway domains set up for a campaign. It resolves to 193.111.63.83 on the PE Skurykhin Mukola Volodumurovuch network, located in the Netherlands. Its free Let's Encrypt certificate gives it a browser padlock, which only means the connection is encrypted. It says nothing about who runs the site.
What to do
Do not log in, register or pay on this site. If you entered a password, change it right away on the genuine service and on any account where you reuse it, and turn on two-factor authentication. If you submitted card or bank details, contact your bank to block the card and dispute any unfamiliar charges. Be wary of follow-up messages that reference your visit. Security teams should block the domain and its IP at DNS and proxy level, search logs for earlier visits, and report the site to the registrar and hosting provider for takedown.
{
"Sophos": "phishing and fraud",
"Webroot": "Phishing and Other Frauds",
"alphaMountain.ai": "Phishing (alphaMountain.ai)",
"Forcepoint ThreatSeeker": "phishing and other frauds"
}
登録情報（ベースドメイン）parik24.expert · 作成日 2026年9月24日 (28d · Very New!)—Expires 2027年9月24日
HTTPステータス200
技術詳細Provenance & timestamps
初確認2026年10月13日
DOM Analysisanalyzed 2026年10月13日score 93/100
Submitted URLhttp://promo.parik24.expert/
Favicon Hash
ケース ID
ICANN OVERSIGHTRegistration: parik24.expert
認定と RAA の背景
レジストラの認定と DNS 不正利用対策の義務
For the registrable domain parik24.expert behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
認定は契約であり、安全性の認証ではありません。
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Evidence layersAvailability: Content servingContent: Content served at rootDNS: ResolvedRegistration: Unknown
Latest HTTP observationコンテンツ公開中Ordinary HTTP content served90%2026-10-22 10:39:48 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-10-22 10:39:48 UTClast content: 2026-10-22 10:39:48 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
