# PhishDestroy threat dossier — 93516365756.com
================================================================

Fetched:   2026-07-23 14:13:15 UTC
Canonical: https://phishdestroy.io/domain/93516365756.com/

## VERDICT
----------------------------------------------------------------
CRITICAL THREAT — DO NOT VISIT
Composite threat score: 100/100 (PhishDestroy scoring — see methodology below)
Scam classification: Credential Phishing
Targeted brand: Bet365

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      15/91 security vendors flagged this domain
  Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, LevelBlue, Lionic, Netcraft, Webroot
URLQuery:        2 detections
Public blocklists: listed on 2 independent blocklists

## INFRASTRUCTURE
----------------------------------------------------------------
IP address:      103.255.47.25 (HK, Tung Chung)
ASN:             ASAS133201 COMING-AS - ABCDE GROUP, HK
Hosting org:     AS133201 ABCDE GROUP
Registrar:       GoDaddy.com, LLC
Nameservers:     elliot.ns.cloudflare.com, kim.ns.cloudflare.com
Registered:      2026-01-23
Expires:         2027-01-23
Page title:      bet365最快线路检测中心
HTTP response:   200

## TLS CERTIFICATE
----------------------------------------------------------------
Issuer:     Asseco Data Systems S.A. / Certum DV TLS G2 R39 CA
Expires:    2027-04-01
Status:     INVALID chain
Fingerprint: f0a4656d48a1e43090b1f9cfde7c9f58cba5f9ade377a1371ad6b0e98cebeae2
Subject Alternative Names (related infrastructure — often same operator):
  - 13757365756.com
  - 14848365756.com
  - 26468365756.com
  - 27308365756.com
  - 33458365756.com
  - 48763365756.com
  - 48978365756.com
  - 53968365756.com
  - 58783365756.com
  - 64161365756.com
  - 70290365756.com
  - 79902365756.com
  - 96659365756.com
  - 98942365756.com
  - www.13757365756.com
  ... +14 more

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: pending notification queue. No abuse reports filed yet — this domain is
waiting for the next cycle of our automated abuse-reporter.

## TIMELINE
----------------------------------------------------------------
Domain registered: 2026-01-23 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration)
First detected:    2026-07-23 02:27:57 UTC (by PhishDestroy tracker)
First reported:    2026-07-23 00:29:19 UTC (abuse notice filed)
Last verified:     2026-07-23 12:27:27 UTC
Current status:    ACTIVE / observable

## EXTERNAL CORROBORATION (third-party evidence)
----------------------------------------------------------------
URLScan.io:       https://urlscan.io/result/019f8c5d-fd79-763d-b7ab-6995e9829176/
URLQuery:         https://urlquery.net/report/6a40d565-b931-45ae-989f-09e2f11ce597
Wayback Machine:  https://web.archive.org/web/*/93516365756.com
crt.sh CT logs:   https://crt.sh/?q=%25.93516365756.com
Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=93516365756.com
AlienVault OTX:   https://otx.alienvault.com/indicator/domain/93516365756.com
URLhaus:          https://urlhaus.abuse.ch/host/93516365756.com/

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-07-23 02:28:43 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

93516365756.com Credential Harvesting Campaign – High Risk

Analysis indicates the domain was registered through GoDaddy on Jan 23 2026. The authoritative nameservers are elliot.ns.cloudflare.com and kim.ns.cloudflare.com, indicating use of Cloudflare DNS. The domain resolves to IP 103.255.47.25, which is currently hosted on an infrastructure that appears in a single security blocklist. VirusTotal reports that 15 of 95 scanning engines have flagged the domain, suggesting malicious behavior.

PhishDestroy has also added the domain to its blocklist. The domain is listed as active, and the risk level is high. No public SSL certificate details, HTTP response codes, or page title information are available in the supplied intelligence, so the content of the site cannot be verified at this time. The lack of observed page metadata means that the exact phishing lure (e.g., credential harvesting, login clone) remains unconfirmed, though the classification as generic phishing aligns with the detection ratios.

Defenders should block DNS resolution to 103.255.47.25 and add 93516365756.com to URL filtering rules. Monitoring of Cloudflare nameserver changes is advised, as the attacker could switch hosting while retaining the same domain. Incident response teams should treat any traffic to this domain as malicious and quarantine related emails or messages. Continued watch‑listing in threat intel feeds is recommended to capture any future changes in detection counts or additional blocklist listings.

## EVIDENCE HASHES
----------------------------------------------------------------
PhishDestroy Case ID:  PD-20260723-1BE2EF
TLS cert SHA-256:      f0a4656d48a1e43090b1f9cfde7c9f58cba5f9ade377a1371ad6b0e98cebeae2

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (operator takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/93516365756.com/
JSON API:          https://api.destroy.tools/v1/check?domain=93516365756.com
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: independent open-source threat-intelligence platform.
Tracked: 188,894 domains (58,543 alive under monitoring, 128,729 confirmed takedowns/dead). Site: https://phishdestroy.io