# PhishDestroy threat dossier — 18778.xyz ================================================================ Fetched: 2026-07-29 07:48:59 UTC Canonical: https://phishdestroy.io/domain/18778.xyz/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 82/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Bet365 ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 14/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, CRDF, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, OpenPhish, SOCRadar, Sophos, Webroot Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 103.244.148.113 (HK, Hong Kong) ASN: AS135357 HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED Hosting org: Shenzhenshihong Technology Development Co., Ltd Registrar: GMO Internet, Inc. Nameservers: a.share-dns.com, a5.share-dns.com, b.share-dns.net, b5.share-dns.net Registered: 2026-06-10 Expires: 2027-06-10 Page title: welcome-BET365 HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-10-21 Status: INVALID chain Fingerprint: cf5ca56a34f30469a311569f26d9c10add4e6c3f4ce847b5fb8a74aa53c441cb Subject Alternative Names (related infrastructure — often same operator): - 17355.xyz - 18651.xyz - 18660.xyz - 18672.xyz - 18747.xyz - 18749.xyz - 18750.xyz - 18751.xyz - 18754.xyz - 18756.xyz - 18757.xyz - 18758.xyz - 18759.xyz - 18762.xyz - 18763.xyz ... +83 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-10 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-28 18:52:29 UTC (by PhishDestroy tracker) First reported: 2026-07-28 17:27:59 UTC (abuse notice filed) Last verified: 2026-07-29 09:34:09 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019fa9c0-8487-77df-a261-22b9ef0cc26d/ URLQuery: https://urlquery.net/report/e81e0230-3cb8-4ae7-bdbf-a7655b332edb Wayback Machine: https://web.archive.org/web/*/18778.xyz crt.sh CT logs: https://crt.sh/?q=%25.18778.xyz Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=18778.xyz AlienVault OTX: https://otx.alienvault.com/indicator/domain/18778.xyz URLhaus: https://urlhaus.abuse.ch/host/18778.xyz/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-28 19:00:41 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] 18778.xyz Generic Phishing Alert The domain 18778.xyz was registered on 10 June 2026 through GMO Internet, Inc. and is currently pointed at the IPv4 address 103.244.148.113. Its authoritative name servers are a.share-dns.com, a5.share-dns.com, b.share-dns.net, and b5.share-dns.net, indicating the use of a shared DNS service common to fast‑flux or disposable hosting infrastructures. VirusTotal has recorded 14 positive detections out of 91 submitted scanners, and the domain is listed on two independent phishing blocklists, including PhishDestroy and OpenPhish. These public listings confirm that the domain is being used in a phishing campaign and that security vendors have observed malicious activity associated with it. As of the report date (28 July 2026) the domain remains active and continues to resolve to the same IP address. No public information is available regarding the website’s page title, SSL certificate details, or the specific brand being spoofed, so the exact visual or credential‑harvesting tactics employed by the site cannot be confirmed at this time. The lack of visible branding or targeted brand data limits attribution but does not diminish the observed risk; the detection count and blocklist presence already classify the domain as high‑risk. Defenders should add 18778.xyz to network‑level deny lists, block outbound connections to its IP address, and ensure that any web filtering solutions ingest the PhishDestroy and OpenPhish feeds that already contain the domain. Continuous monitoring of the associated IP reputation, as well as periodic re‑scanning with VirusTotal or similar multi‑engine services, is advised to capture any changes in the payload or hosting configuration. Because the domain uses a shared DNS provider, related sibling domains may appear in the future; security teams should watch for new hostnames resolving to the same name servers or IP range. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260728-328CDF TLS cert SHA-256: cf5ca56a34f30469a311569f26d9c10add4e6c3f4ce847b5fb8a74aa53c441cb ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/18778.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=18778.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 193,410 domains (83,039 alive under monitoring, 108,073 confirmed takedowns/dead). Site: https://phishdestroy.io