# PhishDestroy domain threat record: 789club.gripe Content language: English Canonical HTML report: https://phishdestroy.io/domain/789club.gripe/ Machine-readable companion: https://phishdestroy.io/domain/789club.gripe/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-27 17:50:05 UTC - Last availability or vendor check: 2026-10-28 00:30:52 UTC - Stored record updated: 2026-10-28 00:30:52 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 104.18.6.205 - Registrar in stored WHOIS data: Spaceship, Inc. - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-06-21 04:57:46 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17e7a-f4d5-734a-bb6a-37c3d58a5006/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/789club.gripe - Certificate Transparency search: https://crt.sh/?q=%25.789club.gripe - Web Archive lookup: https://web.archive.org/web/*/https://789club.gripe/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added 789club.gripe to its internal blocklist on 2026-10-27 after a VirusTotal scan returned a malicious label. The recorded page title read “789Club ⭐ Link Tải App 789 Club Chính Chủ | John Terry Bảo Chứng 2026”, promoting a gaming app. The prior intake assessment noted the page mentions “789Club” and “John Terry” but could not confirm impersonation of a legitimate entity. An HTTP 200 response was observed on the same date. How the scam works The listing does not identify a specific malicious mechanism, but domains that present themselves as official gaming or app download portals often aim to trick visitors into installing untrusted software or disclosing personal credentials. Such pages may use brand names or celebrity endorsements to appear legitimate and can later be used for credential harvesting, ad fraud, or distribution of unwanted software. No direct evidence of these activities was observed on the captured page. Evidence VirusTotal (analysis date 2026-10-27) reported 1 malicious detection out of 92 engines, with LevelBlue labeling the domain as phishing. Google Safe Browsing (checked 2026-10-27) reported no threat. OTX (checked 2026-10-27) listed zero pulses. urlscan.io (captured 2026-10-27) gave a malicious engine score of 79 but an overall verdict of not malicious. PhishDestroy’s internal blocklist marked the domain as blocked, while external blocklists returned zero hits on the same day. Infrastructure The domain was registered on 2026-06-21 through Spaceship, Inc., and a separate WHOIS record indicated creation on 2023-12-09 via Dynadot Inc. The recorded IP address was 104.18.6.205, which belongs to Cloudflare’s network and was associated with Canada in the observation. TLS was provided by Let’s Encrypt, valid from 2026-10-03 to 2027-01-01, and Cloudflare’s WAF was observed. No DNSSEC signatures were present. What to do Visitors should avoid downloading any app or providing credentials on this site; if they have already entered personal information, they should change associated passwords and monitor accounts for unusual activity. Security teams can block the exact domain name and monitor DNS queries for 789club.gripe, as well as inspect logs for connections to the recorded Cloudflare IP. No wallet‑related remediation is required because no wallet interaction was detected. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a17e7a-f4d5-734a-bb6a-37c3d58a5006/ Cloudflare Radar report: https://radar.cloudflare.com/scan/bffb0a38-d062-405b-95dc-3b3c73bddc6b Stored capture screenshot: https://i.ibb.co/h179Yt4G/7cd3ced2e357.png Cloudflare Radar screenshot (2026-10-27T17:50:46Z): https://screenshots.phishdestroy.io/cf/bffb0a38-d062-405b-95dc-3b3c73bddc6b.png VirusTotal report: https://www.virustotal.com/gui/domain/789club.gripe Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=789club.gripe Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-27 17:54:09 UTC ## Stored page captures - Primary capture: https://i.ibb.co/h179Yt4G/7cd3ced2e357.png Captured: 2026-10-27 17:50:05 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a17e7a-f4d5-734a-bb6a-37c3d58a5006.png Captured: 2026-10-27 17:50:05 UTC Source report: https://urlscan.io/result/01a17e7a-f4d5-734a-bb6a-37c3d58a5006/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/bffb0a38-d062-405b-95dc-3b3c73bddc6b.png Captured: 2026-10-27 17:50:46 UTC Source report: https://radar.cloudflare.com/scan/bffb0a38-d062-405b-95dc-3b3c73bddc6b SHA-256: a86dc35c3e92fa8838c8c49f3d3746f67df181f5fb1db5a910960bc57158f18c - URLQuery: https://screenshots.phishdestroy.io/uq/7f3ddbad-7895-437d-a9f9-3430b2a85611.png Source report: https://urlquery.net/report/7f3ddbad-7895-437d-a9f9-3430b2a85611 SHA-256: 32e40e5ea0b7da0188349953e0b5490deb2ab0c704d48080ee25e699da1469c6 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-27T17:53:10Z", "uuid": "01a17e7a-f4d5-734a-bb6a-37c3d58a5006", "scanned_at": "2026-10-27T17:49:20Z", "final_url": "https://789club.gripe/", "status": 200, "ip": "104.18.6.205", "domains": [ "www.google-analytics.com", "www.googletagmanager.com", "connect.facebook.net", "cdn.onesignal.com", "www.google.ca", "stats.g.doubleclick.net", "analytics.google.com", "ad.doubleclick.net", "www.google.com", "cfg.atpman.net" ], "ips": [ "142.251.16.94", "64.233.180.154", "216.239.32.181", "142.251.179.149", "142.251.150.119", "57.144.70.128", "104.16.160.145", "172.253.62.102", "172.253.122.97", "104.18.6.205" ], "asns": [ "15169", "32934", "13335" ], "countries": [ "US" ], "link_domains": [ "www.dmca.com" ], "doc_hash": "1f53adf12f04e40766e611c3bdce95850e5859116f7863dc816414a0c11f51a6", "script_hashes": [ "39a546ea9ad97f8bfaf5d3e0e8f8556adb415e470e59007ada9759dce472adaa", "0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740", "b824b33c95b25786438cb2461a0c316992b3b3ed475758ccfbf1ead9c4922a05", "36aea7eb3dbe1cb16e6853316eaad4989e580dfbb52df145e3e1eb288fe52b96", "dd767b35214cc5549ea0fbe4e5ac72b02b5537b543f9efbe9648facc9a50440b", "2554e30ca4447fbc5bbf0bb91b73a44c85fb9ecdaf592763f1a1c64a25b798fa", "00d7b3422cd101dac466582ad4462b40c11ef0e6255ebafb73089daea0e7dcd1", "b006560585cd1085db1c0d2562db46a29f7c907ff889c1a33067052ccd55ad6d", "cd5e203b3ee7aae55b9623378a46757cc5d9b072c1cc205c18d307e93c946138", "405acde67f1b7e2f225a5c0e23bbfbbbbf0ab1b544aba6dc673e348ff210d947" ], "globals": [ "$", "jQuery", "dataLayer", "google_tag_data", "google_tag_manager", "GoogleAnalyticsObject", "ga", "value", "fbq", "_fbq", "__NUXT__", "__VUE_INSTANCE_SETTERS__", "__VUE_SSR_SETTERS__", "__buildAssetsURL", "__publicAssetsURL", "$fetch", "global", "__unctx__", "__unctx_async_handlers__", "__VUE__", "useNuxtApp", "lottie-player", "litHtmlVersions", "JSCompiler_renameProperty", "litElementVersions", "AOS", "OneSignal", "appId", "gaplugins", "gaGlobal", "gaData", "onYouTubeIframeAPIReady", "__oneSignalSdkLoadCount" ], "cookies": [ "_gcl_au", "__cf_bm", "_gid", "_gat_UA-155986856-1", "_ga_DVNTWCGF94", "_ga", "_fbp", "_ga_SYYYV81KEK" ], "storage_keys": [ "_gcl_ls", "lastExternalReferrer", "lastExternalReferrerTime" ], "tls": { "san": [ "*.789club.gripe", "789club.gripe" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "789club.gripe", "protocol": "TLS 1.3", "valid_to": "2027-01-01T06:18:51Z", "valid_from": "2026-10-03T06:18:52Z" }, "domain_age_days": 1052, "apex_age_days": 1052, "tls_age_days": 24, "tls_valid_days": 89, "requests": 89, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 79, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html;charset=utf-8", "x-powered-by": "Nuxt", "content-security-policy": "frame-ancestors 'self';", "x-frame-options": "SAMEORIGIN" } }, "cf": { "v": 1, "fetched_at": "2026-10-27T17:53:13Z", "uuid": "bffb0a38-d062-405b-95dc-3b3c73bddc6b", "scanned_at": "2026-10-27T17:50:46Z", "final_url": "https://789club.gripe/", "status": 200, "history": [ { "url": "https://789club.gripe/", "status": 200 } ], "dom_hash": "7be5be358811cd2ffa536803795cafddb5f4a77d172de8a56cd1f7c1fbf6acde", "doc_hash": "1f53adf12f04e40766e611c3bdce95850e5859116f7863dc816414a0c11f51a6", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "789club.gripe", "type": "A", "value": "104.18.6.205" }, { "name": "789club.gripe", "type": "A", "value": "104.18.7.205" }, { "name": "789club.gripe", "type": "AAAA", "value": "2606:4700::6812:7cd" }, { "name": "789club.gripe", "type": "AAAA", "value": "2606:4700::6812:6cd" } ], "dnssec_valid": false, "ip": "127.0.1.18" }, "vt": { "v": 1, "fetched_at": "2026-10-27T17:50:40Z", "analysis_at": "2026-10-27T00:34:00Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 1, "suspicious": 0, "undetected": 36 }, "detections": { "LevelBlue": "phishing" }, "reputation": 0, "categories": { "Dr.Web": "gambling" }, "registrar": "Dynadot Inc", "created": "2023-12-09T14:16:39Z", "expires": "2025-12-09T14:16:39Z", "updated": "2024-12-03T09:23:59Z", "first_seen": "2023-12-11T08:01:47Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "anuj.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "anuj.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.18.7.205" }, { "ttl": 300, "type": "A", "value": "104.18.6.205" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700::6812:7cd" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700::6812:6cd" }, { "ttl": 21600, "type": "NS", "value": "hope.ns.cloudflare.com" } ], "dns_at": "2026-10-27T00:34:17Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.789club.gripe", "789club.gripe" ], "issuer": "Let's Encrypt / YE2", "serial": "568b7fd666b2a8a72b00131abfa72fc2ea1", "sha256": "965de0d360bdedbd5d714645aadb81d137464d61494863cda34c22175e677beb", "subject": "789club.gripe", "valid_to": "2027-01-01T06:18:51Z", "valid_from": "2026-10-03T06:18:52Z" }, "whois": { "registrar": "Dynadot Inc", "registrar_iana_id": "472", "registrar_url": "http://dynadot.com", "created": "2023-12-09T14:16:39Z", "updated": "2024-12-03T09:23:59Z", "expires": "2025-12-09T14:16:39Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "gloria.ns.cloudflare.com", "marty.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "last changed": "2026-10-03T07:03:44Z", "registration": "2026-06-21T06:57:46Z", "registrar expiration": "2027-06-21T06:57:46Z", "last update of RDAP database": "2026-10-26T15:48:54Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-27T17:53:35Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "789club.gripe" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-27T17:52:07Z", "first": "2024-03-21T14:52:45Z", "changes": 7, "days_archived": 10, "scans_per_day": 0.01, "avg_page_bytes": 1422 }, "social_tags": { "title": "789Club ⭐ Link Tải App 789 Club Chính Chủ | John Terry Bảo Chứng 2026", "author": "789 Club", "robots": "index, follow", "keywords": "789club, 789 club, game bài đổi thưởng", "description": "789Club là cổng game bài đổi thưởng uy tín nhất 2026 được John Terry bảo chứng. Truy cập 789club.gripe tải app chính chủ, trải nghiệm nạp rút 30s. Đăng ký ngay!", "canonicalUrl": "https://789club.gripe/" }, "trackers": { "requests": 63, "trackers": [ { "name": "Facebook", "company": "Meta", "country": "US", "category": "Advertising", "requests": 3 }, { "name": "Facebook Custom Audience", "company": "Meta", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google Marketing Platform", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 2 }, { "name": "Facebook Connect", "company": "Meta", "country": "US", "category": "Site Analytics", "requests": 2 }, { "name": "Google Analytics", "company": "Google", "country": "US", "category": "Site Analytics", "requests": 3 }, { "name": "Google Tag Manager", "company": "Google", "country": "US", "category": "Utilities", "requests": 1 }, { "name": "OneSignal", "company": "OneSignal", "country": "US", "category": "Utilities", "requests": 2 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 1, "tls": 24, "wait": 591, "connect": 7, "download": 193 }, "response_ms": 816 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 89713, "co2_grams": 0.0033, "cleaner_than": 24 }, "dns_server": { "ns": [ { "ip": "173.245.58.163", "host": "hope.ns.cloudflare.com" }, { "ip": "172.64.33.65", "host": "anuj.ns.cloudflare.com" } ], "zone": "789club.gripe" }, "cookies": { "cookies": [ { "name": "_gcl_au" }, { "name": "__cf_bm", "secure": true, "http_only": true, "same_site": "None" }, { "name": "_gid" }, { "name": "_gat_UA-155986856-1" }, { "name": "_ga_DVNTWCGF94" }, { "name": "_ga" }, { "name": "_fbp", "same_site": "Lax" } ] }, "location": { "ip": "2606:4700::6812:6cd", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Montreal", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "789club.gripe" }, "dns": { "A": [ "104.18.7.205", "104.18.6.205" ], "NS": [ "anuj.ns.cloudflare.com", "hope.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"anuj.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418495273, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700::6812:7cd", "2606:4700::6812:6cd" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": false, "xXSSProtection": "1; mode=block", "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": "frame-ancestors 'self';", "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700::6812:6cd", "family": 6 }, "redirects": { "chain": [ "https://789club.gripe" ] }, "tech_stack": { "technologies": [ "Node.js", "Vue.js", "Nuxt.js", "Slick", "Google Tag Manager", "OneSignal", "lit-html", "lit-element", "jQuery", "Google Analytics", "Facebook Pixel", "core-js", "AOS", "Priority Hints", "Cloudflare", "PWA", "LottieFiles" ] }, "social_presence": { "profiles": [ "https://x.com/789club7", "https://x.com/JohnTerry26" ] }, "linked_pages": { "external": [ "https://www.dmca.com/r/x836pzm" ], "external_count": 1, "internal_count": 6 }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html;charset=utf-8", "x-powered-by": "Nuxt", "content-security-policy": "frame-ancestors 'self';", "x-frame-options": "SAMEORIGIN" } } } } ```