# PhishDestroy domain threat record: 0604416.cc

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/0604416.cc/
Machine-readable companion: https://phishdestroy.io/domain/0604416.cc/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-08-09 22:40:09 UTC
- Last availability or vendor check: 2026-10-25 02:00:45 UTC
- Stored record updated: 2026-10-25 03:20:37 UTC
- VirusTotal detections in the stored snapshot: 5/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Registration date (registry RDAP, 0604416.cc): 2026-03-20 07:15:23 UTC

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/0604416.cc
- Certificate Transparency search: https://crt.sh/?q=%25.0604416.cc
- Web Archive lookup: https://web.archive.org/web/*/https://0604416.cc/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
0604416.cc is a numeric .cc domain that PhishDestroy added to its blocklist after first seeing it on 2026-08-10. No impersonated brand or page title is tied to it, so it is listed as a suspicious domain rather than a confirmed copy of a specific service. The site is now dead: it went offline on 2026-09-13, and on 2026-10-19 its DNS was still inactive.

How the scam works
What links this domain to fraud is outside reputation, not a captured lure page. Spamhaus lists it in its phishing category, and one of the vendors that flags it, PhishFort, specializes in crypto-focused phishing. Together these point to a page built to collect logins, personal details or wallet credentials from people who reached it through links. Throwaway numeric domains like this are typically used for a short campaign and then abandoned, which fits how briefly this one stayed online.

Evidence
On 2026-09-13, five of 89 VirusTotal engines flagged the domain: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, PhishFort and SOCRadar. That is a small share of engines, but the five are independent of each other and include a dedicated anti-phishing provider. Spamhaus DBL carries the domain as DBL_PHISH, and three AlienVault OTX pulses reference it. This means threat researchers outside PhishDestroy have tracked it as well.

Infrastructure
The name is a bare string of digits under the .cc country-code TLD. A name like this imitates nothing, which makes it cheap to register and easy to replace. The domain was active for about a month after PhishDestroy first saw it before going offline, and DNS no longer resolves, so it currently serves nothing.

What to do
If you entered a password or email login on this site, change that password everywhere you reused it and turn on app-based two-factor authentication. If you typed a seed phrase or private key, treat that wallet as compromised and move any remaining funds to a newly created wallet. Be wary of follow-up messages that mention this site or offer to recover losses. Defenders should keep 0604416.cc blocked in DNS and proxy filters even while it is dark, because inactive domains can be reactivated. They should also search logs from 2026-08-10 onward for users who contacted it.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/0604416.cc
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=0604416.cc
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:54:07 UTC

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:31:04Z",
        "uuid": "f2fb3974-fbd1-4afd-8a95-d5df5385742e",
        "scanned_at": "2026-09-12T22:39:21Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T14:54:56Z",
        "analysis_at": "2026-10-12T10:08:32Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 5,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "created": "2026-03-20T00:00:00Z",
        "updated": "2026-03-20T00:00:00Z",
        "first_seen": "2026-03-22T06:32:05Z",
        "dns": [
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "hostmaster.hichina.com",
                "value": "ns7.alidns.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.21"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns8.alidns.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.28"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.26"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.25"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.24"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.30"
            },
            {
                "ttl": 599,
                "type": "CNAME",
                "value": "allicloud.all.pmd6ddza55ymephj.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.27"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "192.253.225.22"
            },
            {
                "ttl": 600,
                "type": "CNAME",
                "value": "allicloud.all.pmd6ddza55ymephj.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns7.alidns.com"
            }
        ],
        "dns_at": "2026-07-13T17:21:04Z",
        "jarm": "40d1db40d0000001dc43d1db1db43db94bcb5f8479d7399568f5de76edd99c",
        "cert": {
            "san": [
                "0604416.cc"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "serial": "79d26b305ebe1f511366f799e959ded2",
            "sha256": "a3332b6fae00879e338acbe4e8585506951d76d96cb6ccad13c546d723253c08",
            "subject": "0604416.cc",
            "valid_to": "2026-09-12T23:59:59Z",
            "valid_from": "2026-06-14T00:00:00Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "transfer prohibited",
                "delete prohibited"
            ],
            "events": {
                "expiration": "2027-03-20T07:15:23Z",
                "last changed": "2026-03-20T07:15:24Z",
                "registration": "2026-03-20T07:15:23Z",
                "registrar expiration": "2027-03-20T07:15:23Z",
                "last update of RDAP database": "2026-03-20T07:15:24Z"
            },
            "registrar": "Porkbun LLC",
            "registrar_iana_id": "1861"
        }
    }
}
```