# PhishDestroy domain threat record: 06171.qpon Content language: English Canonical HTML report: https://phishdestroy.io/domain/06171.qpon/ Machine-readable companion: https://phishdestroy.io/domain/06171.qpon/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-08-09 22:40:09 UTC - Last availability or vendor check: 2026-10-25 02:00:43 UTC - Stored record updated: 2026-10-25 03:20:37 UTC - VirusTotal detections in the stored snapshot: 8/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Registration date (registry RDAP, 06171.qpon): 2026-03-19 18:44:27 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/06171.qpon - Certificate Transparency search: https://crt.sh/?q=%25.06171.qpon - Web Archive lookup: https://web.archive.org/web/*/https://06171.qpon/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview 06171.qpon is a throwaway-looking domain, a five-digit number on the .qpon extension, that sits on the PhishDestroy blocklist. PhishDestroy first saw it on 2026-08-10, but we have not yet assigned it a specific scheme or identified a brand it imitates. The site went offline on 2026-09-13. As of 2026-10-19 its DNS no longer resolves, so the address currently leads nowhere. How the scam works No impersonated brand or page content is tied to this domain, so we cannot say which login or wallet it was built to copy. The phishing labels from Spamhaus and several vendors point to a page meant to trick visitors into handing over something valuable. On crypto-focused phishing sites, that usually means account passwords, one-time codes, a seed phrase, or a wallet connection that gets abused. Randomized numeric names like this one are cheap to register in bulk and are often pushed through links in messages or ads rather than found by typing. Evidence On 2026-09-13, 8 of 89 VirusTotal engines flagged the domain: alphaMountain.ai, BitDefender, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, PhishFort and SOCRadar. That is a minority of engines, but it spans unrelated vendors, and PhishFort specializes in crypto-brand phishing. Spamhaus lists the domain in its DBL under the phishing category, which mail filters and resolvers worldwide use to block it. The domain also appears in 5 AlienVault OTX threat pulses, so other researchers have tracked it as part of malicious activity. Infrastructure The meaningless numeric label and the niche .qpon extension suggest a disposable domain rather than a real business. It went dark about a month after PhishDestroy first saw it, and its DNS is now inactive. That short lifespan is typical of domains that are used briefly and then abandoned or shut down. What to do If you entered a password or 2FA code on this site, change that password everywhere you reused it and reset your two-factor setup. If you typed a seed phrase or private key, treat that wallet as compromised and move any funds to a new wallet created on a clean device. If you connected a wallet, review and revoke the token approvals it granted. Security teams should block the domain at DNS and the mail gateway and search logs from 2026-08-10 onward for users who reached it. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/06171.qpon Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=06171.qpon Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:54:11 UTC ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-21T02:31:04Z", "uuid": "ffea5f0a-c379-40c7-bfcd-2aeafeb9724f", "scanned_at": "2026-09-12T22:39:22Z" }, "vt": { "v": 1, "fetched_at": "2026-10-22T14:54:56Z", "analysis_at": "2026-10-12T13:29:20Z", "stats": { "timeout": 0, "harmless": 50, "malicious": 7, "suspicious": 2, "undetected": 33 }, "detections": { "CRDF": "malicious", "ESET": "suspicious", "VIPRE": "malware", "G-Data": "phishing", "Fortinet": "spam", "SOCRadar": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "created": "2026-03-19T00:00:00Z", "updated": "2026-03-24T00:00:00Z", "first_seen": "2026-03-19T19:35:50Z", "dns": [ { "ttl": 10, "type": "A", "value": "154.93.100.18" }, { "ttl": 600, "type": "CNAME", "value": "tosnwvny.orionxyz.com" }, { "ttl": 7200, "type": "SOA", "rname": "nsadmin.xundns.com", "value": "n1.xundns.com" } ], "dns_at": "2026-07-27T05:48:18Z", "jarm": "2ad2ad0002ad2ad22c42d42d0000003e1c6bdcf3ddc0772f99dffca4dddc83", "cert": { "san": [ "06171.qpon" ], "issuer": "ZeroSSL GmbH / ZeroSSL RSA DV SSL CA 2", "serial": "890aaf2aa2209a0af96e0e26d7cfdf96", "sha256": "b7c0869b72db3644bfeeb39601b49e25ffe77cef028b8e4ea7c9d8b5b9d2c017", "subject": "06171.qpon", "valid_to": "2026-10-13T23:59:59Z", "valid_from": "2026-07-15T00:00:00Z" }, "whois": [] } } ```