# PhishDestroy domain threat record: 7d54cf.icefactory.cl

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/7d54cf.icefactory.cl/
Machine-readable companion: https://phishdestroy.io/domain/7d54cf.icefactory.cl/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-08-26 10:06:38 UTC
- Last availability or vendor check: 2026-10-23 01:00:36 UTC
- Stored record updated: 2026-10-23 22:20:29 UTC
- VirusTotal detections in the stored snapshot: 17/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/7d54cf.icefactory.cl
- Certificate Transparency search: https://crt.sh/?q=%25.7d54cf.icefactory.cl
- Web Archive lookup: https://web.archive.org/web/*/https://7d54cf.icefactory.cl/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
7d54cf.icefactory.cl is a subdomain on the PhishDestroy blocklist. It stands out for its random, hex-style label sitting under a Chilean domain whose name has nothing to do with crypto or finance. PhishDestroy first saw it on 2026-08-26. The site has been offline since 2026-09-13, and on 2026-10-19 its DNS was still not resolving.

How the scam works
No impersonated brand, page title or kit is tied to this host, so its exact scheme is not established. The detections point to a malicious landing page. Disposable subdomains like this one are commonly used to host phishing pages that collect logins or personal data, or that push visitors toward unsafe downloads and wallet interactions. Because the hostname is random, it was likely meant to be reached through a link in a message or ad rather than by typing it.

Evidence
VirusTotal shows 17 of 89 engines flagging the host as of 2026-09-13. That is a meaningful minority from well-known vendors, not a lone outlier. The flagging vendors include alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, ESET, Emsisoft, Forcepoint ThreatSeeker and Fortinet. Chong Lua Dao is a community anti-scam project, so its verdict adds a fraud-focused view to the commercial engines. PhishDestroy is the only blocklist carrying it so far.

Infrastructure
The host went offline on the same day as the VirusTotal check, 2026-09-13, less than three weeks after PhishDestroy first saw it. That short lifespan fits a throwaway deployment. The machine-generated subdomain under an unrelated parent domain suggests the operators wanted a fresh, unremarkable hostname that could be swapped out easily.

What to do
If you opened this site and entered a password, change it right away on that service and on any account that reuses it, and turn on two-factor authentication. If you downloaded or ran anything from the page, scan the device with up-to-date security software and watch your accounts for unfamiliar activity. Treat any message that sent you to this hostname as hostile, and do not trust follow-up messages from the same sender. Defenders should block the hostname at DNS and proxy level and search logs for past visits around 2026-08-26 to 2026-09-13. Watch the parent domain for new random subdomains, since operators often rotate to fresh ones.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/7d54cf.icefactory.cl
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=7d54cf.icefactory.cl
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:53:05 UTC

## Stored page captures

- URLScan · 2026-08-25: https://screenshots.phishdestroy.io/us/01a03904-bf3b-748c-9645-09029811e8b0.png
  Captured: 2026-08-25 13:03:39 UTC
  Source report: https://urlscan.io/result/01a03904-bf3b-748c-9645-09029811e8b0/
  SHA-256: 869dc03015f43eb7bf386e23748de87240b7a1cddacfe0ba4d86c7334cbd5245
- URLScan · 2026-08-25: https://screenshots.phishdestroy.io/us/01a039c2-704e-74cb-b0fc-1f24a17074aa.png
  Captured: 2026-08-25 16:30:56 UTC
  Source report: https://urlscan.io/result/01a039c2-704e-74cb-b0fc-1f24a17074aa/
  SHA-256: 42520c003b92cfb426603182cb22e3bb5998f3e0cd77f43132a83d20cea74d4e
- URLScan · 2026-08-25: https://screenshots.phishdestroy.io/us/01a03aed-0a59-76b1-b433-bf2238359feb.png
  Captured: 2026-08-25 21:56:55 UTC
  Source report: https://urlscan.io/result/01a03aed-0a59-76b1-b433-bf2238359feb/
  SHA-256: 869dc03015f43eb7bf386e23748de87240b7a1cddacfe0ba4d86c7334cbd5245

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:30:51Z",
        "uuid": "e15c0910-c0fc-4acf-aec4-414882358671",
        "scanned_at": "2026-09-13T00:49:54Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T14:53:49Z",
        "analysis_at": "2026-09-25T07:04:57Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 14,
            "suspicious": 2,
            "undetected": 32
        },
        "detections": {
            "ESET": "suspicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "suspicious",
            "Webroot": "malicious",
            "Emsisoft": "malware",
            "Fortinet": "malware",
            "SOCRadar": "phishing",
            "Seclookup": "malicious",
            "BitDefender": "phishing",
            "Criminal IP": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "first_seen": "2026-08-25T10:50:18Z",
        "dns": [
            {
                "ttl": 14400,
                "type": "A",
                "value": "186.64.119.45"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:186.64.119.45 ~all"
            }
        ],
        "dns_at": "2026-08-25T16:31:52Z",
        "jarm": "15d3fd16d29d29d00042d43d0000007cad75e0049912dcaa3fad94e678d707",
        "cert": {
            "san": [
                "*.icefactory.cl",
                "autoconfig.glassy.cl",
                "autodiscover.glassy.cl",
                "cpanel.glassy.cl",
                "cpcalendars.glassy.cl",
                "cpcontacts.glassy.cl",
                "glassy.cl",
                "icefactory.cl",
                "mail.glassy.cl",
                "webdisk.glassy.cl"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "64e3a3752f2f6b5bcdb7d4bf6bc83a7870b",
            "sha256": "e717515227bb9923d07baad259739019c5e7ca8a68e7961386342105d0f66765",
            "subject": "cpcalendars.glassy.cl",
            "valid_to": "2026-11-08T09:07:15Z",
            "valid_from": "2026-08-10T09:07:16Z"
        },
        "whois": {
            "registrar_url": "https://www.nic.cl",
            "created": "2017-12-06 00:38:07 CLST",
            "nameservers": [
                "ns1.pymedns.net",
                "ns2.pymedns.net",
                "ns3.pymedns.net"
            ]
        }
    }
}
```