tivmariq.shop

PhishDestroy first observed tivmariq.shop on Sep 23, 2026. Stored content metadata identifies Unknown as the apparent target. The captured page title is “viphentai.org – viphentai”. Current evidence score: 95/100 (critical).

One source contains a positive finding: VirusTotal. VirusTotal recorded 15 detections among 89 engines: alphaMountain.ai, BitDefender, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, SafeToOpen, Seclookup, SOCRadar, Sophos, VIPRE, Webroot on Sep 23, 2026 at 04:02 UTC. Non-positive and contextual checks: AlienVault OTX listed 5 community pulse references (not vendor detections) on Sep 23, 2026 at 04:03 UTC. The separate external-blocklist snapshot contained no matches on Sep 23, 2026 at 02:20 UTC. Google Safe Browsing returned no flag on Sep 23, 2026 at 04:02 UTC. URLScan completed without a malicious verdict (score 0) on Sep 23, 2026 at 03:30 UTC.

The collector marked the hostname reachable on Sep 23, 2026 at 01:29 UTC, but did not retain the HTTP response code. At collection time, the hostname resolved to 94.154.172.92 (AS209101 IP Vendetta Inc.). The recorded endpoint location is Utrecht, NL. The stored server header is nginx. DOM analysis on Sep 23, 2026 at 02:20 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 3 visual captures from PhishDestroy and URLScan. IoC extraction on Sep 23, 2026 at 04:00 UTC retained 0 format-validated wallet addresses and 1 Telegram indicator. TLS metadata lists YR2 as the certificate issuer.

Stored content provides classification context, but only one source contains a positive finding. The target field identifies Unknown, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.