# PhishDestroy threat dossier — 588gjaoytnjax.shop ================================================================ Fetched: 2026-07-25 14:57:30 UTC Canonical: https://phishdestroy.io/domain/588gjaoytnjax.shop/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 16/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, Certego, Chong Lua Dao, CRDF, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Lionic, SOCRadar, Sophos, VIPRE, Webroot AlienVault OTX: 7 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 83.229.124.67 (HK, Hong Kong) ASN: AS139659 LUCIDACLOUD LIMITED Hosting org: S G IX Registrar: GNAME.COM PTE. LTD. Nameservers: ["a11.share-dns.com", "b11.share-dns.net"] Page title: 401 Authorization Required HTTP response: 301 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YE1 Expires: 2026-10-16 Status: INVALID chain Fingerprint: f27108a8ad97d356f948c387b16c449e851fea3e17967b6ce92fbeb7e0fd0dbc Subject Alternative Names (related infrastructure — often same operator): - nexdoc.83.229.124.67.nip.io ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-19 12:38:03 UTC (by PhishDestroy tracker) Last verified: 2026-07-25 16:20:24 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-20 01:50:52 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] 588gjaoytnjax.shop phishing page demands HTTP auth credentials Analysis of the domain 588gjaoytnjax.shop indicates it is actively hosting a phishing page designed to harvest HTTP Basic Authentication credentials. As of July 19, 2026, the domain returns a 401 Authorization Required page title, suggesting an attempt to prompt users for login details before granting access. The domain resolves to IP address 83.229.124.67, located in Hong Kong (S G IX), and is currently active with a 301 HTTP redirect status. Infrastructure analysis reveals the domain uses nameservers a11.share-dns.com and b11.share-dns.net, and is registered through GNAME.COM PTE. LTD. A Let's Encrypt SSL certificate (YE1) is present, which may lend a false sense of legitimacy to targets. The domain appears in 7 AlienVault OTX threat intelligence pulses and is flagged by 16 of 91 security vendors on VirusTotal, confirming its malicious classification. It is also blocked by PhishDestroy and listed on one additional security blocklist. The exact phishing kit or targeted brand is not yet confirmed in available data, and no specific scam category (e.g., banking, shipping, crypto) has been identified. Defenders should treat this domain as high-risk and block both the domain and its resolving IP at the perimeter. Further investigation into associated infrastructure, such as the nameservers and registrar, may reveal additional linked threats. Due to the 401 response, monitoring for credential harvesting attempts via proxy logs or authentication gateways is recommended. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: f27108a8ad97d356f948c387b16c449e851fea3e17967b6ce92fbeb7e0fd0dbc ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/588gjaoytnjax.shop/ JSON API: https://api.destroy.tools/v1/check?domain=588gjaoytnjax.shop Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 191,133 domains (61,319 alive under monitoring, 128,255 confirmed takedowns/dead). Site: https://phishdestroy.io