# PhishDestroy threat dossier — 462766.com ================================================================ Fetched: 2026-07-29 07:11:57 UTC Canonical: https://phishdestroy.io/domain/462766.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 82/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/91 security vendors flagged this domain Flagging vendors: SOCRadar Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 82.109.249.247 (GB, Reading) ASN: AS3257 GTT Communications Inc. Hosting org: Slumberger Messaging UK Limited Registrar: Dominet (HK) Limited Nameservers: ["ns1.domainnamedns.com", "ns2.domainnamedns.com"] Page title: 彩神(Vll)股份有限公司 - 追求健康一起成长 HTTP response: 301 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-10-07 Status: INVALID chain Fingerprint: c50fb00c4cf08e28788d3be179078081c0f8cb6331da65a68091b130302539d3 Subject Alternative Names (related infrastructure — often same operator): - 031661.com - 109567.com - 115113.com - 117426.com - 129519.com - 140841.com - 159149.com - 165465.com - 174508.com - 179382.com - 218344.com - 221106.com - 290277.com - 357674.com - 372357.com ... +82 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-19 13:01:01 UTC (by PhishDestroy tracker) Last verified: 2026-07-29 04:20:38 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-22 13:19:18 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] 462766.com Safety Check — Chinese Corporate Phishing Detected This domain, 462766.com, is currently active and flagged as a high-risk phishing site targeting Chinese corporate branding. Analysis indicates the domain is hosted on infrastructure associated with Slumberger Messaging UK Limited, resolving to IP address 82.109.249.247. The site returns an HTTP 301 redirect status, suggesting it may be part of a larger redirection chain or staging infrastructure for phishing campaigns. The page title, '彩神(Vll)股份有限公司 - 追求健康一起成长', translates to a corporate entity, potentially mimicking a legitimate Chinese health or investment-related business, though the exact content and target brand remain unverified due to lack of direct page analysis. The domain is registered through Dominet (HK) Limited and uses nameservers ns1.domainnamedns.com and ns2.domainnamedns.com, a pattern observed in other phishing operations leveraging offshore or bulletproof hosting providers. Detected technologies include Nginx, HSTS enforcement, and Baidu Analytics (百度统计), which may be used to track victim interactions or optimize the phishing funnel. The SSL certificate is issued by Let's Encrypt (YR1), a common choice for malicious actors due to its low cost and automation compatibility. As of July 22, 2026, the domain appears on one security blocklist (PhishDestroy) and is flagged by one of 91 security vendors on VirusTotal, indicating low but present detection coverage. Defenders should treat this domain as active phishing infrastructure, particularly given its association with a corporate-themed lure in Chinese. Recommended actions include blocking the domain and IP at perimeter controls, monitoring for related nameserver or registrar patterns, and investigating potential victim interactions via Baidu Analytics IDs if logs are available. The lack of broader detection does not indicate safety; phishing domains often evade initial scans before gaining wider visibility. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: c50fb00c4cf08e28788d3be179078081c0f8cb6331da65a68091b130302539d3 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/462766.com/ JSON API: https://api.destroy.tools/v1/check?domain=462766.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 193,191 domains (82,961 alive under monitoring, 107,970 confirmed takedowns/dead). Site: https://phishdestroy.io