# PhishDestroy domain threat record: 86165q.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/86165q.com/ Machine-readable companion: https://phishdestroy.io/domain/86165q.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-08-09 22:40:09 UTC - Last availability or vendor check: 2026-10-23 01:00:26 UTC - Stored record updated: 2026-10-24 06:20:25 UTC - VirusTotal detections in the stored snapshot: 7/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Registrar in stored WHOIS data: Name.com, Inc. - Registration date (registry RDAP, 86165q.com): 2017-12-13 06:18:21 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/86165q.com - Certificate Transparency search: https://crt.sh/?q=%25.86165q.com - Web Archive lookup: https://web.archive.org/web/*/https://86165q.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview 86165q.com is a domain on the PhishDestroy blocklist that has not yet been assigned a specific scheme type. Its name is a short string of digits and a letter with no recognizable brand in it, so nothing on the surface reveals whom it was meant to fool. PhishDestroy first saw it on 2026-08-10. The site has been offline since 2026-09-13, and it was still dead with no active DNS on 2026-10-19. How the scam works The evidence points to phishing. Spamhaus files the domain under its phishing category, and a crypto-focused anti-phishing vendor is among the engines that flagged it. Phishing sites of this kind usually arrive through a link and ask the visitor to type in credentials, personal details or wallet information, or to approve a transaction. What a victim stands to lose depends on what they entered on the page. No page title or impersonated brand is on file, so the exact lure behind this domain cannot be described. Evidence On 2026-09-13, 7 of 89 VirusTotal engines marked the domain as malicious: alphaMountain.ai, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, PhishFort and SOCRadar. That is a minority of engines, but the flags come from unrelated vendors, including a major antivirus company and a phishing-takedown specialist. Spamhaus lists the domain in its Domain Block List as DBL_PHISH, which means mail and web filters that rely on that feed will block it. Three AlienVault OTX threat pulses also reference the domain, so other researchers have tracked it as well. Infrastructure The domain went dark about five weeks after PhishDestroy first saw it. Its DNS no longer resolves, so the name currently points nowhere. Short-lived, brand-free names like this are cheap to register and easy to abandon, and the same operators may reappear under a fresh domain. What to do If you entered a password on this site, change it everywhere you reused it and turn on two-factor authentication. If you shared card or bank details, contact your bank. If you entered a seed phrase or connected a wallet, move your funds to a new wallet and revoke any token approvals you granted. Treat follow-up messages that mention this domain as further phishing. Defenders should keep the domain blocked even though it is offline, search mail and proxy logs for past contact since 2026-08-10, and watch for lookalike numeric domains that may replace it. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/86165q.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=86165q.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 11:03:54 UTC ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-21T02:30:49Z", "uuid": "197f1740-5f76-4046-be08-3b7e49b9cd7c", "scanned_at": "2026-09-13T01:09:47Z" }, "vt": { "v": 1, "fetched_at": "2026-10-22T14:53:39Z", "analysis_at": "2026-10-03T06:25:07Z", "stats": { "timeout": 0, "harmless": 48, "malicious": 9, "suspicious": 2, "undetected": 33 }, "detections": { "CRDF": "malicious", "ESET": "suspicious", "VIPRE": "malware", "G-Data": "phishing", "CyRadar": "phishing", "SOCRadar": "phishing", "URLQuery": "suspicious", "PhishFort": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "registrar": "Name.com, Inc.", "created": "2017-12-13T06:18:21Z", "expires": "2027-12-13T06:18:21Z", "updated": "2026-08-11T21:03:56Z", "first_seen": "2024-03-18T04:13:07Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "vida.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "vick.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "vick.ns.cloudflare.com" } ], "dns_at": "2026-08-09T01:33:06Z", "jarm": "26d26d16d26d26d22c26d26d26d26d4a98a0d7749fdd12c94fc8482c63007d", "cert": { "san": [ "86165d.com", "www.86165g.com", "86165l.com", "www.86165u.com", "www.86165t.com", "www.86165d.com", "www.86165e.com", "www.86165f.com", "www.86165s.com", "86165s.com" ], "issuer": "Asseco Data Systems S.A. / Certum DV TLS G2 R39 CA", "serial": "3f54cfaa45df495a8ed30ab3ce5a9fc", "sha256": "0f43387339e13595dcbc82d651d85d7c3acf00737eed65b96e47117cb1c22379", "subject": "86165d.com", "valid_to": "2026-10-18T04:50:36Z", "valid_from": "2025-09-18T04:50:37Z" }, "whois": { "registrar": "Name.com, Inc.", "registrar_iana_id": "625", "registrar_url": "http://www.name.com", "created": "2017-12-13T06:18:21Z", "updated": "2026-08-11T21:03:56Z", "expires": "2027-12-13T06:18:21Z", "status": [ "clientHold", "clientTransferProhibited" ], "nameservers": [ "vick.ns.cloudflare.com", "vida.ns.cloudflare.com" ], "dnssec": "unSigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-12-13T06:18:21Z", "last changed": "2026-08-11T21:03:56Z", "registration": "2017-12-13T06:18:21Z", "registrar expiration": "2027-12-13T06:18:21Z", "last update of RDAP database": "2026-08-11T21:03:56Z" } } } } ```