# PhishDestroy domain threat record: 9ckks83c.fmwqzoq.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/9ckks83c.fmwqzoq.com/ Machine-readable companion: https://phishdestroy.io/domain/9ckks83c.fmwqzoq.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-08-26 09:49:19 UTC - Last availability or vendor check: 2026-10-21 01:00:22 UTC - Stored record updated: 2026-10-22 14:20:34 UTC - VirusTotal detections in the stored snapshot: 15/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Registrar in stored WHOIS data: Cloud DNS Ltd - Registration date (registry RDAP, fmwqzoq.com): 2026-08-12 08:15:06 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/9ckks83c.fmwqzoq.com - Certificate Transparency search: https://crt.sh/?q=%25.9ckks83c.fmwqzoq.com - Web Archive lookup: https://web.archive.org/web/*/https://9ckks83c.fmwqzoq.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview 9ckks83c.fmwqzoq.com is a suspicious domain on the PhishDestroy blocklist. PhishDestroy first saw it on 2026-08-26. No impersonated brand or specific target has been identified. The site went offline on 2026-09-13, and its DNS was still inactive at the last check on 2026-10-19. How the scam works No specific scheme has been confirmed for this domain, and no page title or brand ties it to a known campaign. What the evidence does show is a throwaway-looking hostname that a sizeable group of security vendors treat as malicious. Domains in that category typically serve phishing pages, redirect chains to fraudulent offers, or prompts to sign in or connect a wallet. Anyone who reached it should assume that credentials, wallet signatures or payment details entered there could have been captured. Evidence On 2026-09-13, 15 of 89 VirusTotal engines flagged the domain, which is a strong signal for a little-known hostname. The vendors included alphaMountain.ai, BitDefender, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet and G-Data. These are independent engines using different detection methods, so their agreement carries weight. PhishDestroy's own blocklist is the only list that carries the domain. Infrastructure Both labels, 9ckks83c and fmwqzoq, look machine-generated rather than chosen to resemble any brand. Hostnames like this are cheap to create in bulk and easy to discard, which fits an operation that rotates addresses instead of building a recognisable site. The domain was active for under three weeks after PhishDestroy first saw it. It went dark on the same day the VirusTotal detections were recorded. What to do If you entered a password on this site, change it wherever you reuse it and turn on two-factor authentication. If you connected a crypto wallet or signed anything, review and revoke token approvals with a trusted approval checker. If you used a seed phrase, move your funds to a new wallet immediately. If you submitted card details, contact your bank. Defenders should block both 9ckks83c.fmwqzoq.com and the parent fmwqzoq.com at DNS and proxy level, and search logs from 2026-08-26 onward for any internal hosts that contacted them. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/9ckks83c.fmwqzoq.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=9ckks83c.fmwqzoq.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:53:03 UTC ## Stored page captures - URLScan ยท 2026-08-24: https://screenshots.phishdestroy.io/us/01a033dc-230d-740f-bd16-f062973b82cf.png Captured: 2026-08-24 13:01:07 UTC Source report: https://urlscan.io/result/01a033dc-230d-740f-bd16-f062973b82cf/ SHA-256: aeebc0713a912432270e89f7336d923ee94ac5b4ce7503705329516307b2af8f ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-21T02:30:47Z", "uuid": "f016f857-e8d5-4a8a-a0c1-0a44afc79bb8", "scanned_at": "2026-09-13T01:26:27Z" }, "vt": { "v": 1, "fetched_at": "2026-10-22T14:53:31Z", "analysis_at": "2026-09-25T08:17:02Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 13, "suspicious": 1, "undetected": 34 }, "detections": { "CRDF": "malicious", "ESET": "suspicious", "VIPRE": "malware", "G-Data": "malware", "Lionic": "phishing", "Sophos": "malware", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "BitDefender": "malware", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "registrar": "Cloud DNS Ltd", "created": "2026-08-12T08:15:06Z", "expires": "2027-08-12T08:15:06Z", "updated": "2026-10-16T15:10:22Z", "first_seen": "2026-08-24T07:49:33Z", "dns": [ { "ttl": 20, "type": "CNAME", "value": "a6c379079327409z.greycdn.net" }, { "ttl": 56, "type": "CNAME", "value": "dfdcdf8356b74fg.fmwqzoq.com.greycdn.net" }, { "ttl": 600, "type": "CNAME", "value": "cbf825f055034y.greycdn.net" }, { "ttl": 60, "type": "CNAME", "value": "dfdcdf8356b74fg.fmwqzoq.com.greycdn.net" }, { "ttl": 20, "type": "A", "value": "149.104.69.158" } ], "dns_at": "2026-08-24T13:45:59Z", "jarm": "2ad2ad0002ad2ad22c42d43d0000003e1c6bdcf3ddc0772f99dffca4dddc83", "cert": { "san": [ "fmwqzoq.com", "*.fmwqzoq.com" ], "issuer": "ZeroSSL GmbH / ZeroSSL RSA DV SSL CA 2", "serial": "8705864614521d9a5588a66ffe261adc", "sha256": "1a1d0b7cc0a0288d042b87545a30982083f5366402f2c584808095177a826b2d", "subject": "fmwqzoq.com", "valid_to": "2026-11-10T23:59:59Z", "valid_from": "2026-08-12T00:00:00Z" }, "whois": { "registrar": "Cloud DNS Ltd", "registrar_iana_id": "4336", "registrar_url": "https://www.cloudns.net", "created": "2026-08-12T00:00:00Z", "updated": "2026-10-14T15:10:54Z", "expires": "2027-08-12T00:00:00Z", "status": [ "clientHold", "clientTransferProhibited" ], "nameservers": [ "ns1.suspended-domain.com", "ns2.suspended-domain.com" ], "dnssec": "unsigned" } } } ```