# PhishDestroy domain threat record: 4y5twe3.icu Content language: English Canonical HTML report: https://phishdestroy.io/domain/4y5twe3.icu/ Machine-readable companion: https://phishdestroy.io/domain/4y5twe3.icu/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-08-28 19:16:32 UTC - Last availability or vendor check: 2026-10-21 01:00:13 UTC - Stored record updated: 2026-10-22 14:20:31 UTC - VirusTotal detections in the stored snapshot: 13/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Registrar in stored WHOIS data: NicNames, Inc - Registration date (registry RDAP, 4y5twe3.icu): 2026-08-25 14:52:54 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/4y5twe3.icu - Certificate Transparency search: https://crt.sh/?q=%25.4y5twe3.icu - Web Archive lookup: https://web.archive.org/web/*/https://4y5twe3.icu/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview 4y5twe3.icu is a domain on the PhishDestroy blocklist. It does not yet have a final scheme classification, and no impersonated brand has been identified. PhishDestroy first saw it on 2026-08-28. The site went offline on 2026-09-13, and as of 2026-10-19 its DNS no longer resolves, so it is currently unreachable. How the scam works The main signal is Spamhaus, which lists the domain in its phishing category. That points to a page built to trick visitors into handing over something valuable, such as login credentials, recovery phrases or a wallet connection that grants spending rights. A meaningless string on a cheap TLD is typical of throwaway domains that are spread through links in messages, ads or social posts rather than found by search. No specific lure, brand or kit can be attributed to this site, so the realistic risk is general phishing: anything typed or signed there should be treated as compromised. Evidence On 2026-09-13, 13 of 89 VirusTotal engines flagged the domain. Named vendors include alphaMountain.ai, BitDefender, CRDF, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft. Agreement among that many unrelated security vendors, together with the Spamhaus DBL phishing listing, is a stronger signal than any single verdict. The domain also appears in 3 AlienVault OTX threat pulses, so other researchers have tracked it independently. Infrastructure The name 4y5twe3 is a random-looking string on the .icu TLD, the kind of disposable address that costs little to replace once blocked. Its short lifespan fits that pattern: it stopped serving content on 2026-09-13, about two weeks after PhishDestroy first saw it. The DNS is now inactive. What to do If you entered a password or email on this site, change that password everywhere you reused it and turn on app-based two-factor authentication. If you typed a seed phrase or private key, move your funds to a newly created wallet at once, because that phrase can no longer be trusted. If you connected a wallet or signed anything, review and revoke token approvals with a reputable approval checker and watch the wallet for unexpected transfers. Defenders should block the domain at DNS and proxy level, search mail and chat logs for links to it, and keep it blocked in case it comes back online. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/4y5twe3.icu Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=4y5twe3.icu Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:52:59 UTC ## Stored page captures - URLScan · 2026-08-25: https://screenshots.phishdestroy.io/us/01a03b42-add6-71ed-99a0-6baa1a72debf.png Captured: 2026-08-25 23:30:27 UTC Source report: https://urlscan.io/result/01a03b42-add6-71ed-99a0-6baa1a72debf/ SHA-256: ec5ffa42142ad1f5accd7bb32f609ecfa3bb78021259ca6c8afa766cb8582be7 - URLScan · 2026-08-26: https://screenshots.phishdestroy.io/us/01a03ca0-2686-7228-97cc-b077080b3b42.png Captured: 2026-08-26 05:52:10 UTC Source report: https://urlscan.io/result/01a03ca0-2686-7228-97cc-b077080b3b42/ SHA-256: ec5ffa42142ad1f5accd7bb32f609ecfa3bb78021259ca6c8afa766cb8582be7 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-21T02:30:55Z", "uuid": "79f5ca70-be19-4a08-9ee0-37b2ba3b022d", "scanned_at": "2026-09-13T00:09:25Z" }, "vt": { "v": 1, "fetched_at": "2026-10-22T14:54:09Z", "analysis_at": "2026-10-19T12:46:14Z", "stats": { "timeout": 0, "harmless": 43, "malicious": 12, "suspicious": 4, "undetected": 33 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Fortinet": "spam", "SOCRadar": "phishing", "Kaspersky": "phishing", "LevelBlue": "suspicious", "Seclookup": "malicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "registrar": "NicNames, Inc", "created": "2026-08-25T14:52:54Z", "expires": "2027-08-25T23:59:59Z", "updated": "2026-08-30T14:57:19Z", "first_seen": "2026-08-25T16:10:04Z", "dns": [ { "ttl": 300, "type": "A", "value": "104.21.7.143" }, { "ttl": 300, "type": "A", "value": "172.67.187.152" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 redirect=icloud.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "jaime.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "slack-site-verification=DFRCAdGAxNVSOrX61agNOe5pDI0PqPbQFjHq" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::6815:78f" }, { "ttl": 21600, "type": "NS", "value": "jaime.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "vera.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:bb98" }, { "ttl": 300, "type": "MX", "value": "mx01.mail.icloud.com", "priority": 10 } ], "dns_at": "2026-08-27T06:58:49Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "4y5twe3.icu", "*.4y5twe3.icu" ], "issuer": "Google Trust Services / WE1", "serial": "94fc5eb73d570ee20efc2de62a74d733", "sha256": "0d0a03c07d743a4671060f56d2a9fb30292e79a6bfd9c2e7ba988c30c82fb663", "subject": "4y5twe3.icu", "valid_to": "2026-11-23T15:11:44Z", "valid_from": "2026-08-25T14:12:55Z" }, "whois": { "registrar": "NicNames, Inc", "registrar_iana_id": "4156", "registrar_url": "http://www.nicnames.com", "created": "2026-08-25T14:52:54Z", "updated": "2026-08-28T15:54:39Z", "expires": "2027-08-25T23:59:59Z", "status": [ "clientHold", "clientTransferProhibited", "serverHold", "serverTransferProhibited" ], "nameservers": [ "jaime.ns.cloudflare.com", "vera.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```