# PhishDestroy domain threat record: 0.cc Content language: English Canonical HTML report: https://phishdestroy.io/domain/0.cc/ Machine-readable companion: https://phishdestroy.io/domain/0.cc/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-07-27 05:02:12 UTC - Last availability or vendor check: 2026-10-21 22:32:44 UTC - Stored record updated: 2026-10-22 14:20:26 UTC - VirusTotal detections in the stored snapshot: 2/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Registrar in stored WHOIS data: eName Technology Co., Ltd. - Registration date (registry RDAP, 0.cc): 2007-02-17 05:14:43 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/0.cc - Certificate Transparency search: https://crt.sh/?q=%25.0.cc - Web Archive lookup: https://web.archive.org/web/*/https://0.cc/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview 0.cc is a very short, single-character domain that PhishDestroy added to its blocklist after first detecting it on 2026-07-27. No impersonated brand or specific scheme has been confirmed, so it is listed as suspicious rather than tied to a named scam. The site has been dead since 2026-09-13 and was still unreachable when last checked on 2026-10-19. How the scam works Without a confirmed page or brand, the exact lure behind 0.cc cannot be described. What the evidence does show is a domain flagged by web-security vendors and threat-intelligence feeds, which usually points to content that leads visitors toward phishing, credential capture or malicious downloads. Short, memorable domains like this are valuable for redirect chains and shortened links, where a victim may land without ever typing the address. Evidence On 2026-09-13, VirusTotal showed 2 of 89 engines flagging the domain: Forcepoint ThreatSeeker and SOCRadar. That is a low count, but both are vendors that classify web threats and track external attack surface, so their verdicts carry weight. The domain also appears in two AlienVault OTX pulses, meaning other researchers have linked it to tracked malicious activity, and it is on the PhishDestroy blocklist. Infrastructure The domain went offline on 2026-09-13, about seven weeks after PhishDestroy first saw it. That is the same day it was checked on VirusTotal. A short active life followed by abrupt disappearance is a common pattern for disposable malicious domains, though it can also mean the operator simply abandoned it. What to do If you visited 0.cc and typed a password, change it everywhere you reuse it and turn on two-factor authentication. If you entered a wallet recovery phrase or private key anywhere you reached through this domain, treat that wallet as compromised and move your funds to a new one. If you downloaded anything, run a malware scan. Defenders should keep the domain blocked at DNS and proxy level, review logs for traffic between 2026-07-27 and 2026-09-13, and watch for the domain coming back online. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/0.cc Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=0.cc Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:56:14 UTC ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-21T02:31:04Z", "uuid": "e173b3a5-e802-4097-bce2-d2f7c44e3534", "scanned_at": "2026-09-12T22:31:25Z" }, "vt": { "v": 1, "fetched_at": "2026-10-22T14:55:00Z", "analysis_at": "2026-10-13T15:39:39Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 4, "suspicious": 1, "undetected": 34 }, "detections": { "CRDF": "malicious", "SOCRadar": "phishing", "Gridinsoft": "suspicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "eName Technology Co., Ltd.", "created": "2007-02-17T05:14:43Z", "expires": "2031-02-17T05:14:43Z", "updated": "2026-08-10T07:05:07Z", "first_seen": "2023-10-19T11:05:36Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "ns1.ename.net" }, { "ttl": 600, "type": "SOA", "rname": "admin.ename.net", "value": "ns1.ename.net" }, { "ttl": 21600, "type": "NS", "value": "ns2.ename.net" } ], "dns_at": "2026-10-13T16:09:53Z", "whois": { "registrar": "eName Technology Co., Ltd.", "registrar_iana_id": "1331", "registrar_url": "http://www.ename.net", "created": "2007-02-17T05:14:43Z", "updated": "2025-12-30T11:47:08Z", "expires": "2031-02-17T05:14:43Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "ns1.ename.net", "ns2.ename.net" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2031-02-17T05:14:43Z", "registration": "2007-02-17T05:14:43Z", "registrar expiration": "2031-02-17T05:14:43Z", "last update of RDAP database": "2026-08-10T07:05:07Z" } } } } ```