# PhishDestroy domain threat record: 15uy88.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/15uy88.com/
Machine-readable companion: https://phishdestroy.io/domain/15uy88.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-28 10:42:46 UTC
- Last availability or vendor check: 2026-10-28 11:00:23 UTC
- Stored record updated: 2026-10-28 11:30:34 UTC
- VirusTotal detections in the stored snapshot: 12/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.66.148.169
- Registrar in stored WHOIS data: GoDaddy.com, LLC
- Last stored HTTP status: 403
- Registration date in stored WHOIS data: 2026-04-08 08:04:15 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019fc750-d1c3-76a0-a997-20bff32e5eeb/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/15uy88.com
- Certificate Transparency search: https://crt.sh/?q=%25.15uy88.com
- Web Archive lookup: https://web.archive.org/web/*/https://15uy88.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed 15uy88.com as a suspicious domain based on multiple security‑vendor detections of malicious or phishing activity. The domain was first seen by PhishDestroy on 2026-10-28 when an HTTP request returned a 403 status code and no page title was recorded.

How the scam works
The available detections indicate the site could be used for credential harvesting, malware delivery, or fraudulent services, but no specific malicious page content or behavior was observed during the scans. Consequently the listing reflects a risk classification rather than confirmed exploitation.

Evidence
VirusTotal scanned the domain on 2026-10-12 (retrieved 2026-10-28) and reported 12 detections from 92 engines, with 10 classified as malicious and 2 as suspicious; malicious vendors include BitDefender, Chong Lua Dao, CRDF, Fortinet, G-Data, Kaspersky, Lionic, Sophos, VIPRE and Webroot. Google Safe Browsing checked on 2026-10-28 and did not flag the domain. urlscan.io captured a request on 2026-08-03; its overall verdict was clean, while its engine scoring marked the URL malicious with a score of 65. OTX recorded zero pulses as of 2026-10-28. PhishDestroy’s internal blocklist contains the domain, and external blocklists checked on 2026-10-28 reported no listings.

Infrastructure
The domain was registered with GoDaddy.com, LLC on 2026-04-08 and is set to expire on 2034-04-08. DNS records include A entries for 172.66.148.169 and 104.20.21.134 and a CNAME to fallback.vu798pzaw8iabp7n.link, with several CAA records authorizing Let’s Encrypt, Google PKI, ssl.com and DigiCert. The site is served through Cloudflare (ASN 13335) with a TLS certificate issued by Google Trust Services, valid from 2026-09-27 to 2026-12-26, and Cloudflare’s WAF is enabled. The recorded HTTP response on 2026-10-28 was a 403 status.

What to do
Do not enter credentials, personal data or download files from 15uy88.com. If you have already submitted login information, change the associated passwords and enable multi-factor authentication. Network defenders should block the domain at firewalls or proxies and monitor for connections to the listed IP addresses. Keep an eye on reputable threat feeds for any future updates on this domain.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019fc750-d1c3-76a0-a997-20bff32e5eeb/
Cloudflare Radar report: https://radar.cloudflare.com/scan/85d29e53-6cbb-4d82-96dc-9c6e83d4b80e
Stored capture screenshot: https://urlscan.io/screenshots/019fc750-d1c3-76a0-a997-20bff32e5eeb.png
Cloudflare Radar screenshot (2026-10-28T10:45:29Z): https://screenshots.phishdestroy.io/cf/85d29e53-6cbb-4d82-96dc-9c6e83d4b80e.png
VirusTotal report: https://www.virustotal.com/gui/domain/15uy88.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=15uy88.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 10:46:48 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019fc750-d1c3-76a0-a997-20bff32e5eeb.png
  Captured: 2026-10-28 10:42:46 UTC
- URLScan capture: https://screenshots.phishdestroy.io/019fc750-d1c3-76a0-a997-20bff32e5eeb.png
  Source report: https://urlscan.io/result/019fc750-d1c3-76a0-a997-20bff32e5eeb/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/85d29e53-6cbb-4d82-96dc-9c6e83d4b80e.png
  Captured: 2026-10-28 10:45:29 UTC
  Source report: https://radar.cloudflare.com/scan/85d29e53-6cbb-4d82-96dc-9c6e83d4b80e
  SHA-256: ad99a09c8ce1be040e50253ddf1838cc9a00ffacb2f36b8f59dca46feaed3ba8

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-28T10:45:53Z",
        "uuid": "019fc750-d1c3-76a0-a997-20bff32e5eeb",
        "scanned_at": "2026-08-03T11:09:59Z",
        "final_url": "https://www.15uy88.com/",
        "status": 403,
        "redirects": [
            {
                "to": "https://www.15uy88.com/",
                "from": "https://www.15uy88.com/",
                "status": 307
            }
        ],
        "ip": "172.66.148.169",
        "domains": [
            "challenges.cloudflare.com"
        ],
        "ips": [
            "104.18.94.41",
            "104.18.95.41",
            "172.66.148.169"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.cloudflare.com"
        ],
        "doc_hash": "a8fe9a3a33628ba15d8f3d9cf3e37a9d8e8736c455c5e5e70b2c94f43a022df4",
        "script_hashes": [
            "c856a17f5a47eb8b9a076d9aa6ff84e9eabf23300f1a18635e56b9ba8b33a31b",
            "e0953c0595e0f74a7cc26ac2f221778f2cf735a9374121d6734dc83334629bbe"
        ],
        "globals": [
            "_cf_chl_opt",
            "PcwpM1",
            "zwkl3",
            "Umfld6",
            "tVLDA6",
            "lsCoh3",
            "XIbc5",
            "runProgram",
            "FzfP8",
            "sHTRZ3",
            "rwlM0",
            "XDwob5",
            "ciGxY4",
            "Xmme0",
            "RDKgF1",
            "ohvA4",
            "xZqa4",
            "NwzH4",
            "vvyW7",
            "kArk3",
            "hkXm9",
            "RwFb8",
            "YGQp6",
            "Xhss2",
            "QyKn1",
            "GRog2",
            "gXLI1",
            "xEWO3",
            "okgq9",
            "STriV4",
            "angular",
            "UvIvl9",
            "QnuD6",
            "RlVfT4",
            "turnstile",
            "AyYh6",
            "vVBW5",
            "DiwfR8",
            "fNMC7"
        ],
        "cookies": [
            "cf_clearance",
            "cf_chl_rc_ni"
        ],
        "tls": {
            "san": [
                "www.15uy88.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "www.15uy88.com",
            "protocol": "QUIC",
            "valid_to": "2026-10-28T16:05:08Z",
            "valid_from": "2026-07-30T15:05:14Z"
        },
        "domain_age_days": 62,
        "apex_age_days": 116,
        "tls_age_days": 3,
        "tls_valid_days": 90,
        "requests": 19,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 65,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "content-security-policy": "default-src 'none'; script-src 'nonce-AV4xEMWYbSKhR6Kfz4cwDI' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.clou",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin",
            "permissions-policy": "accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),s",
            "cross-origin-opener-policy": "same-origin",
            "cross-origin-resource-policy": "same-origin",
            "cross-origin-embedder-policy": "require-corp"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-28T10:45:56Z",
        "uuid": "85d29e53-6cbb-4d82-96dc-9c6e83d4b80e",
        "scanned_at": "2026-10-28T10:45:29Z",
        "final_url": "https://15uy88.com/",
        "status": 403,
        "history": [
            {
                "url": "https://15uy88.com/",
                "status": 403
            }
        ],
        "dom_hash": "09471bf8e29d5571159827bc83d881c38e2f56d8a5b71911b3689b846bb80841",
        "doc_hash": "3fffe0a5535711d66b319135526ed99e02c72d97835205ffa34453f8e39a4298",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "15uy88.com",
                "type": "CNAME",
                "value": "fallback.vu798pzaw8iabp7n.link"
            },
            {
                "name": "15uy88.com",
                "type": "CNAME",
                "value": "fallback.vu798pzaw8iabp7n.link"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.9",
        "whois": {
            "registrar": "GoDaddy.com, LLC",
            "created": "2026-04-08T10:04:15Z",
            "updated": "2026-06-01T15:15:53Z",
            "expires": "2034-04-08T10:04:15Z",
            "nameservers": [
                "ns1.cdnetdns.net",
                "ns2.cdnetdns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T10:44:47Z",
        "analysis_at": "2026-10-12T19:35:36Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 10,
            "suspicious": 2,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "Kaspersky": "phishing",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "suspicious"
        },
        "reputation": 0,
        "popularity": {
            "Majestic": 542742,
            "Cloudflare Radar": 1000000
        },
        "created": "2026-04-08T00:00:00Z",
        "updated": "2026-04-08T00:00:00Z",
        "first_seen": "2026-04-09T07:28:56Z",
        "dns": [
            {
                "ttl": 300,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.66.148.169"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "pki.goog;"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.cdnetdns.net"
            },
            {
                "ttl": 3600,
                "type": "CNAME",
                "value": "fallback.vu798pzaw8iabp7n.link"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "pki.goog;"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.cdnetdns.net"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "ssl.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.20.21.134"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "ssl.com"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "dnsadmin.cdnetworks.com",
                "value": "ns1.cdnetdns.net"
            }
        ],
        "dns_at": "2026-10-12T19:40:50Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "15uy88.com"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "23aab0d12abc202a130844e322a3cb14",
            "sha256": "a0f999f2cb779b062510287286254595f0f1fbee16e0408aab2f2302b29d0041",
            "subject": "15uy88.com",
            "valid_to": "2026-12-26T19:07:41Z",
            "valid_from": "2026-09-27T18:07:46Z"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client renew prohibited",
                "client transfer prohibited",
                "client update prohibited"
            ],
            "events": {
                "expiration": "2034-04-08T10:04:15Z",
                "last changed": "2026-06-01T15:15:53Z",
                "registration": "2026-04-08T10:04:15Z",
                "last update of RDAP database": "2026-10-12T18:30:07Z"
            },
            "registrar": "GoDaddy.com, LLC",
            "registrar_iana_id": "146"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-28T10:46:18Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "count": 8,
            "domain": "15uy88.com",
            "issuers": [
                "letsencrypt.org",
                "pki.goog; cansignhttpexchanges=yes",
                "ssl.com",
                "digicert.com"
            ]
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "location": {
            "ip": "104.20.21.134",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "15uy88.com"
        },
        "dns": {
            "A": [
                "172.66.148.169",
                "104.20.21.134"
            ],
            "CNAME": [
                "fallback.vu798pzaw8iabp7n.link"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": true
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "104.20.21.134",
            "family": 4
        },
        "rank": {
            "domain": "15uy88.com"
        },
        "subdomains": {
            "count": 2,
            "subdomains": [
                "m.15uy88.com",
                "www.15uy88.com"
            ]
        },
        "whois": {
            "registrar": "GoDaddy.com, LLC",
            "created": "2026-04-08T10:04:15Z",
            "updated": "2026-06-01T15:15:53Z",
            "expires": "2034-04-08T10:04:15Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientRenewProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp",
                "clientUpdateProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.cdnetdns.net",
                "ns2.cdnetdns.net"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8",
                "content-security-policy": "default-src 'none'; script-src 'nonce-TmI2zGNzvz217p7tchRBW5' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenge",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin",
                "permissions-policy": "accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*",
                "cross-origin-opener-policy": "same-origin",
                "cross-origin-resource-policy": "same-origin",
                "cross-origin-embedder-policy": "require-corp"
            }
        }
    }
}
```