# PhishDestroy threat dossier — 797772.com ================================================================ Fetched: 2026-07-25 03:35:17 UTC Canonical: https://phishdestroy.io/domain/797772.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 12/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, SOCRadar, Sophos Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 87.85.106.247 (DE, Düsseldorf) ASN: AS3257 GTT Communications Inc. Hosting org: GTT - EMEA Ltd Registrar: Dominet (HK) Limited Nameservers: ["ns1.domainnamedns.com", "ns2.domainnamedns.com"] HTTP response: 301 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-10-07 Status: INVALID chain Fingerprint: 1d62998e89491e5c741106f80245e5faf641071bb35eb02632f01edc92c6864b Subject Alternative Names (related infrastructure — often same operator): - 011406.com - 014695.com - 014887.com - 080135.com - 080166.com - 154458.com - 166389.com - 189755.com - 208871.com - 257605.com - 305028.com - 312535.com - 366291.com - 377464.com - 474088.com ... +83 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-19 13:00:57 UTC (by PhishDestroy tracker) Last verified: 2026-07-25 04:13:12 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-22 19:18:59 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] 797772.com: Confirmed Phishing Site Analysis of 797772.com as of July 22, 2026 indicates that the domain is actively serving a phishing infrastructure. The domain resolves to the IPv4 address 87.85.106.247, which is hosted in Germany and assigned to GTT – EMEA Ltd. Registration data shows the registrar as Dominet (HK) Limited, a privacy‑friendly registrar frequently used by malicious operators. DNS resolution is performed by ns1.domainnamedns.com and ns2.domainnamedns.com. An HTTPS service is present, secured with a Let's Encrypt certificate (YR1), which does not provide any reputational assurance. HTTP requests receive a 301 redirect response, but the final landing page has not been captured, leaving the exact phishing lure undefined. On the detection side, 12 of 91 security vendors on VirusTotal have flagged the domain as malicious, indicating a moderate level of consensus among scanners. The domain is currently listed on one external blocklist and is explicitly blocked by the PhishDestroy mitigation service, confirming that at least some security vendors consider it hostile. No additional signals such as Safe Browsing, OTX, or public threat‑intel reports are available, and the page title or targeted brand have not been disclosed. Given the active status, defenders should add 797772.com to local deny lists, block its resolving IP address 87.85.106.247, and monitor traffic for any outbound connections to the domain or its name servers. Continuous re‑evaluation is advised, as the redirect target may change and further analysis of the landing page could reveal additional indicators of compromise. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 1d62998e89491e5c741106f80245e5faf641071bb35eb02632f01edc92c6864b ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/797772.com/ JSON API: https://api.destroy.tools/v1/check?domain=797772.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 189,386 domains (59,697 alive under monitoring, 128,126 confirmed takedowns/dead). Site: https://phishdestroy.io