# PhishDestroy domain threat record: 0567421.cc

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/0567421.cc/
Machine-readable companion: https://phishdestroy.io/domain/0567421.cc/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-08-09 22:40:09 UTC
- Last availability or vendor check: 2026-10-25 02:00:43 UTC
- Stored record updated: 2026-10-25 03:20:37 UTC
- VirusTotal detections in the stored snapshot: 5/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Registration date (registry RDAP, 0567421.cc): 2026-03-28 07:10:00 UTC

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/0567421.cc
- Certificate Transparency search: https://crt.sh/?q=%25.0567421.cc
- Web Archive lookup: https://web.archive.org/web/*/https://0567421.cc/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
0567421.cc is a numeric .cc domain that PhishDestroy added to its blocklist on 2026-08-10. Spamhaus lists it as a phishing domain. We have not identified an impersonated brand or a specific scheme. The site went offline on 2026-09-13 and was still dead with no active DNS on 2026-10-19.

How the scam works
The evidence points to phishing: a page built to trick visitors into handing over something of value. That is usually login credentials, personal details or crypto wallet access, entered on a form that looks legitimate. Throwaway numeric domains like this one are typically pushed through direct messages, spam or ads rather than found by search. Victims follow a link and act before noticing the address is wrong. The exact lure behind 0567421.cc is not established, so treat anything you typed or approved there as potentially exposed.

Evidence
On 2026-09-13, five of 89 VirusTotal engines flagged the domain: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, PhishFort and SOCRadar. That is a small share of engines. Still, PhishFort specialises in phishing takedowns and SOCRadar in threat intelligence, so their flags carry weight. Spamhaus places the domain on its Domain Block List with a phishing tag (DBL_PHISH), which many mail and network filters use to block traffic. Three AlienVault OTX pulses also reference it, meaning other researchers have tied it to tracked malicious activity.

Infrastructure
The name is a string of digits under the .cc country-code extension. A meaningless name like this is cheap to register and easy to abandon, and it is rarely chosen for a genuine service. Its DNS no longer resolves, so the operation behind it appears to have moved on. Similar numeric domains may be used for the same campaign.

What to do
If you entered a password or email on this site, change that password immediately, along with anywhere you reused it. Then turn on app-based two-factor authentication. If you shared personal or payment details, watch your accounts and alert your bank or card issuer. If you entered a wallet seed phrase, move your funds to a new wallet right away. Defenders should block the domain at DNS and mail gateways and search logs for past visits. They should also watch for lookalike numeric .cc domains appearing in links.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/0567421.cc
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=0567421.cc
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:54:07 UTC

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:31:04Z",
        "uuid": "432b91cc-bc92-4848-968e-dae66449fc7c",
        "scanned_at": "2026-09-12T22:34:06Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T14:54:57Z",
        "analysis_at": "2026-10-12T10:08:29Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 5,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "created": "2026-03-28T00:00:00Z",
        "updated": "2026-03-28T00:00:00Z",
        "first_seen": "2026-03-31T03:31:11Z",
        "dns": [
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.26"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.24"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns7.alidns.com"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "hostmaster.hichina.com",
                "value": "ns7.alidns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns8.alidns.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.21"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.30"
            },
            {
                "ttl": 600,
                "type": "CNAME",
                "value": "allicloud.all.pmd6ddza55ymephj.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.27"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.22"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.28"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.25"
            },
            {
                "ttl": 534,
                "type": "CNAME",
                "value": "allicloud.all.pmd6ddza55ymephj.com"
            }
        ],
        "dns_at": "2026-07-13T22:02:30Z",
        "jarm": "40d1db40d0000001dc43d1db1db43db94bcb5f8479d7399568f5de76edd99c",
        "cert": {
            "san": [
                "0567421.cc"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "serial": "773eac84576467531c738bc73c852212",
            "sha256": "794d7473fc93f68d8e67d10543ac6665f18bc1262be41e28216388d2417ece3d",
            "subject": "0567421.cc",
            "valid_to": "2026-09-20T23:59:59Z",
            "valid_from": "2026-06-22T00:00:00Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "transfer prohibited",
                "delete prohibited"
            ],
            "events": {
                "expiration": "2027-03-28T07:10:00Z",
                "last changed": "2026-03-28T07:10:00Z",
                "registration": "2026-03-28T07:10:00Z",
                "registrar expiration": "2027-03-28T07:10:00Z",
                "last update of RDAP database": "2026-03-28T07:10:00Z"
            },
            "registrar": "Porkbun LLC",
            "registrar_iana_id": "1861"
        }
    }
}
```