# PhishDestroy threat dossier — 62384.xyz ================================================================ Fetched: 2026-07-25 17:24:53 UTC Canonical: https://phishdestroy.io/domain/62384.xyz/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 16/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safe Browsing, Gridinsoft, LevelBlue, Lionic, SOCRadar, Sophos, VIPRE, Webroot Public blocklists: listed on 1 independent blocklist Google Safe Browsing: FLAGGED ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 103.27.177.163 (HK, Mong Kok) ASN: AS135357 HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED Hosting org: HONG KONG KOWLOON TELECOMMUNICATIONS CO., LIMITED Registrar: Gname.com Pte. Ltd. Nameservers: ["a4.share-dns.com", "b4.share-dns.net"] ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-09-13 Status: INVALID chain Fingerprint: 2b50f17d1f30e96dc205210e442abe94110c6727aa9032416f903c8f7ff148c6 Subject Alternative Names (related infrastructure — often same operator): - 62336.xyz - 62337.xyz - 62338.xyz - 62343.xyz - 62386.xyz - 62396.xyz - 62398.xyz - 62401.xyz - 62408.xyz - 62411.xyz - 62420.xyz - 62441.xyz - 62447.xyz - 62464.xyz - 62468.xyz ... +84 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-19 13:01:25 UTC (by PhishDestroy tracker) Last verified: 2026-07-25 16:20:22 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-19 14:03:22 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] 62384.xyz: Confirmed Phishing Site Analysis of the domain 62384.xyz as of July 19 2026 indicates that it is currently operating as a high‑risk phishing resource. Google Safe Browsing classifies the site under the social‑engineering category, confirming that the URL is being used to lure victims into disclosing credentials or personal data. An HTTP GET request returns a 200 OK response, showing that the server is actively serving content. The domain has been added to one public blocklist and is already being filtered by the PhishDestroy mitigation platform, demonstrating that at least one defensive product has incorporated the indicator. VirusTotal reports that 16 of 95 scanned security engines flag the domain as malicious, providing independent corroboration of its hostile intent. The presence of multiple detections across distinct AV engines suggests that the site hosts typical phishing payloads rather than a one‑off test. No additional intelligence such as hosting ASN, country of registration, or associated malware kits is available, leaving the underlying infrastructure opaque. Defenders should immediately block outbound connections to 62384.xyz at the firewall level, add the domain to DNS sinkhole lists, and ensure that web‑filtering solutions reference the current blocklist entry. Endpoint protection products that ingest VirusTotal data will likely already generate alerts; analysts should prioritize those alerts for investigation. Continuous monitoring of the domain’s reputation is advised, as the threat actor may modify the payload or create new related domains in the future. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 2b50f17d1f30e96dc205210e442abe94110c6727aa9032416f903c8f7ff148c6 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/62384.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=62384.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 191,947 domains (62,133 alive under monitoring, 128,255 confirmed takedowns/dead). Site: https://phishdestroy.io