# PhishDestroy domain threat record: 0039.vip Content language: English Canonical HTML report: https://phishdestroy.io/domain/0039.vip/ Machine-readable companion: https://phishdestroy.io/domain/0039.vip/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-08-09 22:40:09 UTC - Last availability or vendor check: 2026-10-25 02:01:09 UTC - Stored record updated: 2026-10-25 03:20:37 UTC - VirusTotal detections in the stored snapshot: 14/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Registration date (registry RDAP, 0039.vip): 2026-03-20 03:23:49 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/0039.vip - Certificate Transparency search: https://crt.sh/?q=%25.0039.vip - Web Archive lookup: https://web.archive.org/web/*/https://0039.vip/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview 0039.vip is a short numeric .vip domain on the PhishDestroy blocklist. It does not yet have a specific scheme classification, and no impersonated brand or page title has been tied to it. PhishDestroy first saw it on 2026-08-10. The site has been offline since 2026-09-13, and on 2026-10-19 its DNS was still inactive. How the scam works No particular brand, kit or lure is confirmed for 0039.vip. What is established is that Spamhaus places it in its phishing category, which means it was used, or prepared, to trick visitors into handing over something of value. Phishing domains in the crypto space typically ask for login credentials, seed phrases or private keys, or push visitors to send funds or approve transactions. Anyone who reached this domain while it was live should treat whatever they typed or authorized there as potentially exposed. Evidence On 2026-09-13, 14 of 89 VirusTotal engines flagged the domain. That is a minority, but the agreement spans unrelated vendors, including ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, ESET, Forcepoint ThreatSeeker, Fortinet and G-Data. Spamhaus lists it in its Domain Block List under DBL_PHISH, an independent phishing verdict separate from the antivirus engines. Three AlienVault OTX pulses reference the domain, so other researchers have also tracked it as malicious. Infrastructure The domain was active for roughly five weeks between PhishDestroy's first sighting on 2026-08-10 and the site going offline on 2026-09-13. The VirusTotal check landed on that same day. Throwaway-style numeric names on inexpensive TLDs like .vip are easy to register in bulk and abandon, and this one went dark quickly. Its DNS no longer resolves, but a domain like this can be reactivated if the registration remains in place. What to do If you entered a password or account login on 0039.vip, change it on the real service and on any site that shares it, then turn on app-based two-factor authentication. If you typed a seed phrase or private key, consider that wallet compromised and move any funds to a newly created wallet. If you sent money or payment details, contact your bank or exchange and report the transaction right away. Defenders should keep the domain blocked even while it is dead and search proxy and DNS logs for connections between 2026-08-10 and 2026-09-13. They should also watch for the domain resolving again. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/0039.vip Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=0039.vip Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:54:07 UTC ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-21T02:31:04Z", "uuid": "fc6db0a4-9be1-4dd7-be3e-17ff95306a60", "scanned_at": "2026-09-12T22:31:23Z" }, "vt": { "v": 1, "fetched_at": "2026-10-22T14:54:58Z", "analysis_at": "2026-10-12T19:09:37Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 14, "suspicious": 0, "undetected": 34 }, "detections": { "ESET": "phishing", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "PhishFort": "phishing", "ADMINUSLabs": "malicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "created": "2026-03-20T00:00:00Z", "updated": "2026-03-20T00:00:00Z", "first_seen": "2026-03-20T04:41:28Z", "dns": [ { "ttl": 3600, "type": "TXT", "value": "google-site-verification=up-CTizhwk_6mLBLGk8MWaXtXypEcesS9O3YOAKCUuA" }, { "ttl": 300, "type": "A", "value": "154.196.3.140" }, { "ttl": 21600, "type": "NS", "value": "lakas.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "gabriella.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "gabriella.ns.cloudflare.com" } ], "dns_at": "2026-07-13T18:01:35Z", "jarm": "3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763", "cert": { "san": [ "0039.vip", "36078.vip", "50078.vip", "www.0039.vip", "www.36078.vip", "www.50078.vip" ], "issuer": "Let's Encrypt / R12", "serial": "5503cdf545e07ce18344e7fa7f0ee16155f", "sha256": "48556d8517b59c070c0b76ff1228e0d5c0eb1c08ad6ebbce3f574790994a7a78", "subject": "50078.vip", "valid_to": "2026-08-17T10:36:29Z", "valid_from": "2026-05-19T10:36:30Z" }, "whois": [], "rdap": { "status": [ "client hold", "client transfer prohibited" ], "events": { "expiration": "2027-03-20T03:23:49Z", "registration": "2026-03-20T03:23:49Z", "last update of RDAP database": "2026-10-06T02:52:31Z" }, "registrar": "Gname.com Pte. Ltd.", "registrar_iana_id": "1923" } } } ```