# PhishDestroy threat dossier — 3658nike5253.cc ================================================================ Fetched: 2026-07-27 22:43:25 UTC Canonical: https://phishdestroy.io/domain/3658nike5253.cc/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Bet365 ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 9/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, CRDF, Emsisoft, Forcepoint ThreatSeeker, Fortinet, LevelBlue, Netcraft, SOCRadar, Webroot AlienVault OTX: 4 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 104.214.176.120 (HK, Hong Kong) ASN: AS8075 Microsoft Corporation Hosting org: Microsoft Azure Cloud (eastasia) Registrar: Dynadot Inc Nameservers: ["ns1.dns.com", "ns2.dns.com"] Page title: bet365 HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-09-22 Status: INVALID chain Fingerprint: d36658d03af0973f391ed68adfa57dd4912d08cd37ae9dc42baa1ae77347ed86 Subject Alternative Names (related infrastructure — often same operator): - 3658nike5249.cc - 3658nike5250.cc - 3658nike5251.cc - 3658nike5252.cc - 3658nike5254.cc - 3658nike5255.cc - 3658nike5256.cc - 3658nike5257.cc - 3658nike5258.cc - www.3658nike5249.cc - www.3658nike5250.cc - www.3658nike5251.cc - www.3658nike5252.cc - www.3658nike5253.cc - www.3658nike5254.cc ... +4 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-27 14:33:10 UTC (by PhishDestroy tracker) Last verified: 2026-07-27 20:20:20 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-27 14:34:51 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] 3658nike5253.cc: Confirmed Phishing Site Analysis of 3658nike5253.cc indicates that the domain is currently active and returns HTTP 200 responses, confirming that a web service is reachable. Registration records show the domain was created through Dynadot Inc, and the authoritative name servers are ns1.dns.com and ns2.dns.com. VirusTotal has recorded detections from nine out of ninety‑one scanning engines, suggesting that multiple security products have identified malicious behavior associated with the host. The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy service, providing an additional layer of protection for downstream users. Publicly available intelligence does not include details such as the underlying IP address, geographic hosting location, SSL certificate attributes, page title, or explicit brand targeting. Consequently, the precise phishing kit or content served by the site cannot be confirmed at this time. The lack of deeper content analysis means that defenders cannot rely on signature‑based indicators beyond the domain name itself. Given the confirmed activity, defenders should implement domain‑level mitigation. Network perimeter devices, secure web gateways, and DNS filtering solutions should be configured to block or sinkhole 3658nike5253.cc. Incident response teams should monitor outbound traffic for connections to the domain and correlate any observed authentication attempts with known credential‑theft patterns. Threat‑intel feeds that ingest blocklist data should be updated to include the domain, and security appliances that integrate VirusTotal scores should be set to treat the nine positive detections as a high‑confidence indicator of compromise. Continuous monitoring of the registrar’s WHOIS records and name‑server changes is advised, as shifts in infrastructure could signal escalation or re‑hosting of the phishing campaign. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 815edeb1c8a19ff834705df7cc458dad TLS cert SHA-256: d36658d03af0973f391ed68adfa57dd4912d08cd37ae9dc42baa1ae77347ed86 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/3658nike5253.cc/ JSON API: https://api.destroy.tools/v1/check?domain=3658nike5253.cc Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 207,542 domains (82,445 alive under monitoring, 124,066 confirmed takedowns/dead). Site: https://phishdestroy.io