# PhishDestroy threat dossier — 100109.cc ================================================================ Fetched: 2026-07-25 17:24:27 UTC Canonical: https://phishdestroy.io/domain/100109.cc/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 16/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safe Browsing, LevelBlue, Lionic, SOCRadar, Sophos, VIPRE, Webroot Public blocklists: listed on 1 independent blocklist Google Safe Browsing: FLAGGED ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 103.27.177.163 (HK, Mong Kok) ASN: AS135357 HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED Hosting org: HONG KONG KOWLOON TELECOMMUNICATIONS CO., LIMITED Registrar: Gname.com Pte. Ltd. Nameservers: ["a12.share-dns.com", "b12.share-dns.net"] Page title: Welcome HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-09-14 Status: INVALID chain Fingerprint: 96f7e0af8eee310b2f8e0ea1fac8ebb784ea00b51c1624e34a0ac65da5e346d9 Subject Alternative Names (related infrastructure — often same operator): - 100027.cc - 100031.cc - 100036.cc - 100037.cc - 100038.cc - 100062.cc - 100073.cc - 100079.cc - 100083.cc - 100156.cc - 13779.xyz - 13791.xyz - 13806.xyz - 13809.xyz - 13824.xyz ... +75 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-19 13:00:45 UTC (by PhishDestroy tracker) Last verified: 2026-07-25 16:20:23 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-22 12:42:03 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] 100109.cc Generic Phishing Page Alert Analysis of the domain 100109.cc indicates active phishing infrastructure as of July 22, 2026. The domain is registered through Gname.com Pte. Ltd. and resolves to IP address 103.27.177.163, hosted by a provider in Hong Kong under KOWLOON TELECOMMUNICATIONS CO., LIMITED. The site returns an HTTP 200 status code, signaling an operational web server, and presents a page titled 'Welcome,' though the exact content and target of the phishing attempt remain unconfirmed due to limited public analysis. Infrastructure review reveals the use of Nginx as the web server, alongside front-end libraries including Bootstrap, Swiper, Moment.js, and jQuery, which are common in both legitimate and malicious sites. The SSL certificate is issued by Let's Encrypt (YR2), a frequently observed certificate authority in phishing campaigns due to its free and automated issuance process. The domain is currently flagged by Google Safe Browsing for social engineering, and PhishDestroy has implemented blocking measures. One security blocklist includes the domain, while VirusTotal reports 16 detections out of 91 security vendors, confirming its malicious classification by multiple engines. Nameservers associated with the domain are a12.share-dns.com and b12.share-dns.net, which have been previously linked to other suspicious domains. No specific brand impersonation has been identified in available data, and the threat type remains classified as generic phishing. Defenders are advised to block the domain at DNS and proxy levels, monitor for connections to 103.27.177.163, and review logs for user access attempts. Further investigation into the site's content and payload delivery mechanisms is recommended to determine the precise phishing vector. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 96f7e0af8eee310b2f8e0ea1fac8ebb784ea00b51c1624e34a0ac65da5e346d9 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/100109.cc/ JSON API: https://api.destroy.tools/v1/check?domain=100109.cc Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 191,947 domains (62,133 alive under monitoring, 128,255 confirmed takedowns/dead). Site: https://phishdestroy.io