phantom[.]api[.]industry[.]shop

phantom.api.industry.shop is a subdomain of industry.shop. PhishDestroy first observed the hostname on Feb 3, 2026. The hostname explicitly references Phantom; stored content metadata identifies the same apparent target. The captured page title is “502 Bad Gateway”. Stored page analysis classifies the content as crypto scam. Current evidence score: 80/100 (critical).

One source contains a positive finding: VirusTotal. VirusTotal recorded 5 detections among 91 engines: CRDF, Forcepoint ThreatSeeker, Gridinsoft, LevelBlue, Webroot on Jul 26, 2026 at 03:22 UTC. Non-positive and contextual checks: The external blocklist snapshot contained no matches on Aug 7, 2026 at 22:20 UTC. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:54 UTC.

HTTP 301 was recorded on Aug 7, 2026 at 22:20 UTC. Registration records for the registrable domain industry.shop list GoDaddy.com, LLC as the registrar. At collection time, the hostname resolved to 159.196.71.225 on AS4764 (Aussie Broadband). The recorded endpoint location is Melbourne, AU. The stored server header is nginx/1.28.0. DOM analysis on Apr 23, 2026 at 07:21 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 1 visual capture from PhishDestroy. TLS metadata lists Let's Encrypt / R12 as the certificate issuer with validity through May 2, 2026; checked Mar 15, 2026 at 05:48 UTC.

Stored content provides classification context, but only one source contains a positive finding.