# PhishDestroy domain threat record: 68656v.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/68656v.com/
Machine-readable companion: https://phishdestroy.io/domain/68656v.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-08-09 22:40:09 UTC
- Last availability or vendor check: 2026-10-23 01:00:25 UTC
- Stored record updated: 2026-10-24 06:20:24 UTC
- VirusTotal detections in the stored snapshot: 14/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Registrar in stored WHOIS data: Name.com, Inc.
- Registration date (registry RDAP, 68656v.com): 2025-08-13 10:38:51 UTC

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/68656v.com
- Certificate Transparency search: https://crt.sh/?q=%25.68656v.com
- Web Archive lookup: https://web.archive.org/web/*/https://68656v.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
68656v.com is a domain on the PhishDestroy blocklist, first seen by our team on 2026-08-10. Its name is a short run of digits ending in a single letter. It does not resemble any brand, so the danger comes from where it was linked, not from what it imitates. The site is now dead: it has been offline since 2026-09-13, and on our last check on 2026-10-19 its DNS was still inactive.

How the scam works
We have not tied this domain to a specific scheme, kit or impersonated brand. The phishing listings point to a page built to get visitors to hand over something of value, most often login credentials, personal details or payment information. Domains named like this one are usually reached through links in messages, ads or redirects, not typed by hand. Anyone who landed there should treat whatever they entered as exposed.

Evidence
On 2026-09-13, 14 of 89 VirusTotal engines flagged the domain. They include ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, ESET and Fortinet. That is a minority of engines, but it is a broad, independent mix of vendors. Spamhaus lists the domain on its DBL with a phishing classification, and it appears in four AlienVault OTX threat pulses. These signals agree with each other, which is why the domain sits on our blocklist despite the missing scheme details.

Infrastructure
There is little infrastructure left to examine, because the domain no longer resolves. It went offline on 2026-09-13, the same day as the VirusTotal check, and was still unresolvable on 2026-10-19. That short run of about a month after we first saw it is typical of disposable phishing domains, which are dropped once they are flagged. The DNS could be reactivated later, so the listings remain relevant.

What to do
If you typed a password into this site, change it immediately. Change it everywhere you reused it, and turn on two-factor authentication. If you entered card or banking details, contact your bank and watch for unfamiliar charges. If you shared personal information, expect follow-up phishing messages that reference it. Security teams should block the domain at DNS and proxy level. They should also search logs for lookups or visits between 2026-08-10 and 2026-09-13 to identify users who may need to reset credentials.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/68656v.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=68656v.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:54:20 UTC

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:30:52Z",
        "uuid": "f9272d2d-1c13-4a4e-bfd1-9b90ebfd6a73",
        "scanned_at": "2026-09-13T00:41:44Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T14:53:58Z",
        "analysis_at": "2026-10-12T08:40:24Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 15,
            "suspicious": 0,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "PhishFort": "phishing",
            "ADMINUSLabs": "malicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Name.com, Inc.",
        "created": "2025-08-13T10:38:51Z",
        "expires": "2027-08-13T10:38:51Z",
        "updated": "2026-08-11T21:01:28Z",
        "first_seen": "2025-08-16T16:08:29Z",
        "dns": [
            {
                "ttl": 7200,
                "type": "NS",
                "value": "n1.xundns.com"
            },
            {
                "ttl": 10,
                "type": "A",
                "value": "20.24.218.31"
            },
            {
                "ttl": 7200,
                "type": "NS",
                "value": "n2.xundns.com"
            },
            {
                "ttl": 600,
                "type": "CNAME",
                "value": "bnuwqpdm.orionedg.com"
            }
        ],
        "dns_at": "2026-07-27T05:48:35Z",
        "jarm": "2ad2ad0002ad2ad22c42d42d0000003e1c6bdcf3ddc0772f99dffca4dddc83",
        "cert": {
            "san": [
                "68656v.com"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL RSA DV SSL CA 2",
            "serial": "3f970fda538788d3f56fd5c9d4527e5f",
            "sha256": "f0d56cead931c993ee66710b747b1139e42d9760bbe1a0ac2aa8ac90e40a5bdc",
            "subject": "68656v.com",
            "valid_to": "2026-09-28T23:59:59Z",
            "valid_from": "2026-06-30T00:00:00Z"
        },
        "whois": {
            "registrar": "Name.com, Inc.",
            "registrar_iana_id": "625",
            "registrar_url": "http://www.name.com",
            "created": "2025-08-13T10:38:51Z",
            "updated": "2026-08-11T21:01:28Z",
            "expires": "2027-08-13T10:38:51Z",
            "status": [
                "clientHold",
                "clientTransferProhibited",
                "inactive"
            ],
            "dnssec": "unSigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-08-13T10:38:51Z",
                "last changed": "2026-08-11T21:01:28Z",
                "registration": "2025-08-13T10:38:51Z",
                "registrar expiration": "2027-08-13T10:38:51Z",
                "last update of RDAP database": "2026-08-11T21:01:28Z"
            }
        }
    }
}
```