cheapyet[.]pro

PhishDestroy first observed cheapyet.pro on Apr 21, 2026. The captured page title is “CheapYet — ChatGPT Plus for $3/month”. Current evidence score: 100/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, Google Safe Browsing, Spamhaus DBL, and URLQuery. VirusTotal recorded 16 detections among 91 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safebrowsing, Gridinsoft, Lionic, SOCRadar, Sophos, VIPRE on Jul 10, 2026 at 01:20 UTC. Google Safe Browsing flagged the domain: Social Engineering on Apr 22, 2026 at 05:00 UTC. Spamhaus DBL: DBL_SPAM on Jul 13, 2026 at 18:35 UTC. URLQuery recorded 3 detections; no observation timestamp was retained. Non-positive and contextual checks: AlienVault OTX listed 1 community pulse reference (not vendor detections) on Apr 21, 2026 at 11:19 UTC. The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 06:20 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:41 UTC.

HTTP 200 was recorded on Aug 7, 2026 at 22:14 UTC. Registration records for the domain list Fewmoretaps OU d/b/a Trustname.com as the registrar and Apr 21, 2026 as the creation date. Registration and first observation occurred on the same UTC date. At collection time, the hostname resolved to 78.40.143.202 on AS45839 (Shinjiru Technology Sdn Bhd). The recorded endpoint location is Kuala Lumpur, MY. The stored server header is LiteSpeed. The evidence archive retains 1 visual capture from PhishDestroy. TLS metadata lists Let's Encrypt / R13 as the certificate issuer with validity through May 30, 2026; checked Apr 21, 2026 at 08:00 UTC.

The content indicators and 4 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.