# PhishDestroy domain threat record: 0139234.cc

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/0139234.cc/
Machine-readable companion: https://phishdestroy.io/domain/0139234.cc/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-08-09 22:40:09 UTC
- Last availability or vendor check: 2026-10-25 02:00:43 UTC
- Stored record updated: 2026-10-26 07:20:22 UTC
- VirusTotal detections in the stored snapshot: 5/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Registration date (registry RDAP, 0139234.cc): 2026-04-10 08:44:20 UTC

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/0139234.cc
- Certificate Transparency search: https://crt.sh/?q=%25.0139234.cc
- Web Archive lookup: https://web.archive.org/web/*/https://0139234.cc/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
0139234.cc is a numeric .cc domain on the PhishDestroy blocklist. No impersonated brand or page content has been tied to it, but outside reputation services independently label it as phishing. PhishDestroy first saw it on 2026-08-10. It went offline on 2026-09-13, and as of 2026-10-19 its DNS no longer resolves, so the site cannot currently be reached.

How the scam works
The Spamhaus listing and the vendor verdicts point to a phishing page, meaning a site built to get visitors to hand over something valuable. That is usually login credentials, personal details or payment information typed into a fake form. Throwaway numeric domains like this one are often passed around through links in messages, ads or redirects rather than typed in by hand, and they are abandoned quickly once flagged. Nothing ties this domain to a specific brand or kit, so the exact lure is not established.

Evidence
Five of 89 VirusTotal engines flagged the domain in the 2026-09-13 scan: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, PhishFort and SOCRadar. That is a modest count, but PhishFort is a phishing-focused vendor and the others are separate commercial feeds, so the verdicts do not come from a single source. Spamhaus DBL lists the domain in its phishing category, which many mail filters and resolvers use to block it automatically. The domain also appears in three AlienVault OTX threat pulses, so other researchers have independently tracked it.

Infrastructure
The name is a string of digits under the .cc country-code extension, with no brand wording at all. That pattern fits disposable domains created in bulk and swapped out as each one gets blocked. The site went dark roughly five weeks after PhishDestroy first logged it, and its DNS is now inactive. That matches a short-lived operation rather than an established website.

What to do
If you entered a password on this site, change it right away, along with any account that reuses it, and turn on two-factor authentication. If you submitted card or banking details, contact your bank to block the card and dispute any unfamiliar charges. Treat any follow-up message that references this domain as suspicious, even though the site is currently offline. Defenders should block 0139234.cc at DNS, proxy and mail gateways and search logs for past visits to identify users who may need to reset their credentials.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/0139234.cc
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=0139234.cc
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:54:08 UTC

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:31:05Z",
        "uuid": "bf41858a-6a6e-47d1-81b8-486178473626",
        "scanned_at": "2026-09-12T22:34:06Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T14:54:58Z",
        "analysis_at": "2026-10-12T16:46:56Z",
        "stats": {
            "timeout": 0,
            "harmless": 50,
            "malicious": 4,
            "suspicious": 3,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "LevelBlue": "suspicious",
            "alphaMountain.ai": "suspicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "created": "2026-04-10T00:00:00Z",
        "updated": "2026-04-10T00:00:00Z",
        "first_seen": "2026-04-17T03:40:49Z",
        "dns": [
            {
                "ttl": 600,
                "type": "CNAME",
                "value": "allicloud.all.pmd6ddza55ymephj.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns7.alidns.com"
            },
            {
                "ttl": 599,
                "type": "CNAME",
                "value": "allicloud.all.pmd6ddza55ymephj.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.28"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.22"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.26"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.30"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.21"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.27"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns8.alidns.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.25"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.24"
            }
        ],
        "dns_at": "2026-07-14T09:06:06Z",
        "jarm": "40d1db40d0000001dc43d1db1db43db94bcb5f8479d7399568f5de76edd99c",
        "cert": {
            "san": [
                "0139234.cc"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "serial": "275e26287185723e5f0b2b8756f44f9",
            "sha256": "cd07d050161d4a348e1390cb3c3269e269a8ed9c0ef731527a57476878a3ef07",
            "subject": "0139234.cc",
            "valid_to": "2026-10-04T23:59:59Z",
            "valid_from": "2026-07-06T00:00:00Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "transfer prohibited",
                "delete prohibited"
            ],
            "events": {
                "expiration": "2027-04-10T08:44:20Z",
                "last changed": "2026-04-10T08:44:20Z",
                "registration": "2026-04-10T08:44:20Z",
                "registrar expiration": "2027-04-10T08:44:20Z",
                "last update of RDAP database": "2026-04-10T08:44:20Z"
            },
            "registrar": "Porkbun LLC",
            "registrar_iana_id": "1861"
        }
    }
}
```