# PhishDestroy threat dossier — 13988.xyz ================================================================ Fetched: 2026-07-22 13:50:57 UTC Canonical: https://phishdestroy.io/domain/13988.xyz/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 17/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safe Browsing, Gridinsoft, LevelBlue, Lionic, SOCRadar, Sophos, VIPRE, Webroot Public blocklists: listed on 1 independent blocklist Google Safe Browsing: FLAGGED ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 103.27.177.164 (HK, Mong Kok) ASN: AS135357 HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED Hosting org: HONG KONG KOWLOON TELECOMMUNICATIONS CO., LIMITED Registrar: Dynadot Inc Nameservers: ["a1.share-dns.com", "b1.share-dns.net"] Page title: Welcome ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-09-12 Status: INVALID chain Fingerprint: ad033b761a9c0c357f482c91faec86911234b621ef34f3d6fdfefc80e2ce5814 Subject Alternative Names (related infrastructure — often same operator): - 13984.xyz - 13986.xyz - 13987.xyz - 13991.xyz - 13993.xyz - 13995.xyz - 13997.xyz - 14020.xyz - 14030.xyz - 14031.xyz - 14033.xyz - 14042.xyz - 14043.xyz - 14044.xyz - 14045.xyz ... +83 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-19 13:00:57 UTC (by PhishDestroy tracker) Last verified: 2026-07-22 12:23:21 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-19 16:55:40 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] 13988.xyz: Confirmed Phishing Site Analysis of the domain 13988.xyz as of July 19, 2026 indicates that the site is actively serving malicious content designed to harvest credentials. VirusTotal reports that 17 of 91 security vendors have flagged the domain, demonstrating consensus among scanning engines that the host is involved in malicious activity. Google Safe Browsing classifies the URL as a social engineering threat, reinforcing the phishing attribution. The site returns HTTP 200, confirming that a web server is operational and reachable by clients. Blocklist data shows that the domain appears on at least one public security blocklist, and the PhishDestroy feed has already listed it as blocked, providing early warning to downstream filters. Infrastructure details such as hosting IP, ASN, or geolocation have not been disclosed in the available intelligence, so the underlying infrastructure remains unknown. The lack of additional context, such as page title or target brand, limits attribution to a specific campaign, but the convergence of multiple independent detections establishes a high confidence that the domain is being used for credential harvesting. Defenders should immediately block 13988.xyz at DNS and proxy layers, update web filtering policies to include the domain, and monitor for outbound connections to the host. Incident response teams should inspect any authentication attempts made to accounts that may have been exposed, and consider password resets if compromise is suspected. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: ad033b761a9c0c357f482c91faec86911234b621ef34f3d6fdfefc80e2ce5814 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/13988.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=13988.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 188,066 domains (57,511 alive under monitoring, 128,922 confirmed takedowns/dead). Site: https://phishdestroy.io