# PhishDestroy domain threat record: 097876.sbs Content language: English Canonical HTML report: https://phishdestroy.io/domain/097876.sbs/ Machine-readable companion: https://phishdestroy.io/domain/097876.sbs/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-08-09 22:40:09 UTC - Last availability or vendor check: 2026-10-25 02:00:42 UTC - Stored record updated: 2026-10-25 03:20:37 UTC - VirusTotal detections in the stored snapshot: 7/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Registration date (registry RDAP, 097876.sbs): 2025-09-29 14:21:55 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/097876.sbs - Certificate Transparency search: https://crt.sh/?q=%25.097876.sbs - Web Archive lookup: https://web.archive.org/web/*/https://097876.sbs/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview 097876.sbs is a suspicious domain on the PhishDestroy blocklist. Its name is just six digits on the low-cost .sbs extension, with no brand in it, so nothing in the name itself tells a visitor whose site it claims to be. PhishDestroy first saw it on 2026-08-10. The site went offline on 2026-09-13, and on 2026-10-19 the domain still no longer resolved in DNS. How the scam works PhishDestroy has not yet assigned this domain a scheme type, and no impersonated brand has been identified. The Spamhaus phishing listing and the vendor verdicts point to a page built to collect something from visitors, such as login details, personal information or, on crypto-themed lures, wallet access. Links to throwaway numeric domains like this usually reach people through spam messages, chat links or ads, and many are dropped within weeks. Anything entered on such a page goes straight to whoever controls the domain. Evidence Spamhaus lists 097876.sbs in its Domain Block List under the phishing category, which is the clearest independent label on it. On VirusTotal, 7 of 89 engines flagged the domain as of 2026-09-13: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, LevelBlue, PhishFort, SOCRadar and Webroot. That count is modest, but PhishFort, a phishing-focused vendor, is among them. Three AlienVault OTX threat pulses also reference the domain, so other researchers have tracked it as part of malicious activity. Infrastructure The domain's lifespan was short. PhishDestroy recorded it on 2026-08-10, and it stopped serving content on 2026-09-13, the same day as the latest VirusTotal check. A randomly numbered name on a cheap extension is easy to register in bulk and abandon once blocklists catch up. Its DNS has stayed inactive since then, so it is not currently reachable. What to do If you entered a password on this site, change it at once on that service and anywhere you reuse it, and turn on two-factor authentication. If you shared card or banking details, contact your bank. If you connected a crypto wallet or approved anything, review and revoke token approvals with a trusted approval checker, and move funds to a fresh wallet if you typed in a seed phrase. Defenders should block 097876.sbs at DNS and proxy level and search mail and web logs since 2026-08-10 for users who reached it. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/097876.sbs Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=097876.sbs Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:54:07 UTC ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-21T02:31:04Z", "uuid": "8de8d531-89e5-4d30-8b99-b3f3dbcac655", "scanned_at": "2026-09-12T22:39:22Z" }, "vt": { "v": 1, "fetched_at": "2026-10-22T14:54:55Z", "analysis_at": "2026-10-12T11:51:00Z", "stats": { "timeout": 0, "harmless": 48, "malicious": 6, "suspicious": 2, "undetected": 36 }, "detections": { "CRDF": "malicious", "Webroot": "malicious", "Fortinet": "spam", "SOCRadar": "phishing", "LevelBlue": "suspicious", "PhishFort": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "created": "2025-09-29T00:00:00Z", "updated": "2025-09-29T00:00:00Z", "first_seen": "2025-09-29T16:26:50Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "jermaine.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "jermaine.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "jo.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "103.82.214.79" } ], "dns_at": "2026-07-22T12:08:59Z", "jarm": "3fd3fd0003fd3fd21c42d42d000000307ee0eb468e9fdb5cfcd698a80a67ef", "cert": { "san": [ "02411.sbs", "16260.sbs", "25163.sbs", "26426.sbs", "40026.sbs", "57126.sbs", "74626.sbs", "75462.sbs", "85614.sbs", "96516.sbs" ], "issuer": "Let's Encrypt / YR1", "serial": "55307f29e952927f17575fc6195147e79eb", "sha256": "35783fd24b4c960336d1692ed1edaeec575894bf6ade0d43e8699fb44936d8ee", "subject": "www.26426.sbs", "valid_to": "2026-10-16T15:14:20Z", "valid_from": "2026-07-18T15:14:21Z" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2026-09-29T23:59:59Z", "last changed": "2025-11-21T04:22:13Z", "registration": "2025-09-29T14:21:55Z", "last update of RDAP database": "2026-04-10T10:31:41Z" }, "registrar": "Dynadot LLC", "registrar_iana_id": "472" } } } ```