# PhishDestroy domain threat record: 72395v.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/72395v.com/
Machine-readable companion: https://phishdestroy.io/domain/72395v.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-08-09 22:40:09 UTC
- Last availability or vendor check: 2026-10-23 01:00:20 UTC
- Stored record updated: 2026-10-24 06:20:25 UTC
- VirusTotal detections in the stored snapshot: 14/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Registrar in stored WHOIS data: Name.com, Inc.
- Registration date (registry RDAP, 72395v.com): 2025-08-22 06:07:58 UTC

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/72395v.com
- Certificate Transparency search: https://crt.sh/?q=%25.72395v.com
- Web Archive lookup: https://web.archive.org/web/*/https://72395v.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
72395v.com is a suspicious domain on the PhishDestroy blocklist. Its name is a string of digits and one letter with no recognizable brand, so it gives visitors nothing to judge it by. PhishDestroy first saw it on 2026-08-10. The site has been offline since 2026-09-13, and on 2026-10-19 its DNS was still inactive.

How the scam works
We have not tied the site to a specific scheme, brand or kit. The strongest signal is Spamhaus, which lists the domain under its phishing category. That points to a page built to capture logins, personal details or payment information. Throwaway numeric domains like this are often spread through direct messages, ads or redirect chains rather than typed by hand, so most people who reached it were probably sent there by a link.

Evidence
VirusTotal shows 14 of 89 engines flagging the domain as of 2026-09-13. That is a minority, but the vendors are independent of each other: alphaMountain.ai, BitDefender, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet and G-Data. Spamhaus DBL lists the domain as phishing (DBL_PHISH), a separate source that agrees with those vendors. AlienVault OTX references it in four threat pulses, which means other researchers have tracked it too.

Infrastructure
The domain is no longer resolving, and the VirusTotal check that recorded 14 detections falls on the same day the site went dark. The site was live for about five weeks between PhishDestroy's first sighting and going offline. A dead domain can be reactivated or re-pointed, so the listing stays useful even while the site is down.

What to do
If you typed a password, email address or other credentials into this site, change that password now, plus anywhere else you reused it, and turn on two-factor authentication. If you entered card or bank details, contact your bank to block the card and dispute any charges you do not recognize. Treat any follow-up messages that mention this site as hostile. Security teams should block 72395v.com at DNS and proxy level and search logs for lookups since 2026-08-10 to find users who may have visited.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/72395v.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=72395v.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:54:23 UTC

## Stored page captures

- URLScan · 2026-07-28: https://screenshots.phishdestroy.io/us/019fa748-e5bf-74cb-ada8-a61221885bbd.png
  Captured: 2026-07-28 05:53:37 UTC
  Source report: https://urlscan.io/result/019fa748-e5bf-74cb-ada8-a61221885bbd/
  SHA-256: 017797f94a27abffba2167af9e4f1ee7638759677f897b3dc2af66f6f69d24de

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:30:52Z",
        "uuid": "71b957ee-e19b-4875-b4a7-b9be679bd862",
        "scanned_at": "2026-09-13T00:43:44Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T14:53:58Z",
        "analysis_at": "2026-10-12T04:11:55Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 11,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Name.com, Inc.",
        "created": "2025-08-22T06:07:58Z",
        "expires": "2027-08-22T06:07:58Z",
        "updated": "2026-08-11T21:01:29Z",
        "first_seen": "2025-08-25T16:04:04Z",
        "dns": [
            {
                "ttl": 600,
                "type": "CNAME",
                "value": "bnuwqpdm.orionedg.com"
            },
            {
                "ttl": 7200,
                "type": "SOA",
                "rname": "nsadmin.xundns.com",
                "value": "n1.xundns.com"
            },
            {
                "ttl": 10,
                "type": "A",
                "value": "20.24.220.169"
            },
            {
                "ttl": 7200,
                "type": "NS",
                "value": "n1.xundns.com"
            },
            {
                "ttl": 7200,
                "type": "NS",
                "value": "n2.xundns.com"
            }
        ],
        "dns_at": "2026-07-27T05:48:54Z",
        "jarm": "2ad2ad0002ad2ad22c42d42d0000003e1c6bdcf3ddc0772f99dffca4dddc83",
        "cert": {
            "san": [
                "72395v.com"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL RSA DV SSL CA 2",
            "serial": "63f8c73c0a1dbf4ae4848124688de185",
            "sha256": "56ee6bfbe75801b0230b93a46538570078444487df2ab1c2ae3cfcd192659d15",
            "subject": "72395v.com",
            "valid_to": "2026-09-29T23:59:59Z",
            "valid_from": "2026-07-01T00:00:00Z"
        },
        "whois": {
            "registrar": "Name.com, Inc.",
            "registrar_iana_id": "625",
            "registrar_url": "http://www.name.com",
            "created": "2025-08-22T06:07:58Z",
            "updated": "2026-08-11T21:01:29Z",
            "expires": "2027-08-22T06:07:58Z",
            "status": [
                "clientHold",
                "clientTransferProhibited",
                "inactive"
            ],
            "dnssec": "unSigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-08-22T06:07:58Z",
                "last changed": "2026-08-11T21:01:29Z",
                "registration": "2025-08-22T06:07:58Z",
                "registrar expiration": "2027-08-22T06:07:58Z",
                "last update of RDAP database": "2026-08-11T21:01:29Z"
            }
        }
    }
}
```