# Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn) — PhishDestroy Threat Report Source: https://phishdestroy.io/domain/?registrar=Alibaba+Cloud+Computing+Ltd.+d%2Fb%2Fa+HiChina+%28www.net.cn%29 Generated: 2026-04-21T18:54:13+00:00 ## Registrar profile Brand: HiChina / Alibaba IANA ID: 420 Country: CN Founded: 2000 Website: https://net.cn ## Threat statistics - Flagged phishing domains in PhishDestroy DB: 168 - Still alive (not yet taken down): 7 (4.2%) - Taken down: 159 - VirusTotal-detected: 159 (94.6% detection rate) - Avg VT detections (non-zero): 11.4 - High-confidence threats (VT ≥ 5): 116 - First flagged: 2025-07-22 12:00:07 - Last flagged: 2026-04-20 14:43:11 - Total domains under registrar (NetAPI): 1,797,367 - PhishDestroy share of registrar portfolio: 0.009% ## Sample flagged domains (top 50 by VT detections) - darb.qmobilitysl.com [VT:24, status:dead] → https://phishdestroy.io/domain/darb.qmobilitysl.com/ - darb.qmobilitysis.com [VT:21, status:dead] → https://phishdestroy.io/domain/darb.qmobilitysis.com/ - gopay13.eqxd.top [VT:21, status:dead] → https://phishdestroy.io/domain/gopay13.eqxd.top/ - gopay21.eqxd.top [VT:21, status:dead] → https://phishdestroy.io/domain/gopay21.eqxd.top/ - gopay4.kyiu.top [VT:21, status:dead] → https://phishdestroy.io/domain/gopay4.kyiu.top/ - ilmxs.com [VT:21, status:dead] → https://phishdestroy.io/domain/ilmxs.com/ - darb.qmobilitysig.com [VT:20, status:dead] → https://phishdestroy.io/domain/darb.qmobilitysig.com/ - darb.qmobilitysio.com [VT:20, status:dead] → https://phishdestroy.io/domain/darb.qmobilitysio.com/ - darb.qmobilitysiu.com [VT:20, status:dead] → https://phishdestroy.io/domain/darb.qmobilitysiu.com/ - gopay12.kyiu.top [VT:20, status:dead] → https://phishdestroy.io/domain/gopay12.kyiu.top/ - auth--bitbuy-cda--cdn-azure.dora.run [VT:19, status:dead] → https://phishdestroy.io/domain/auth--bitbuy-cda--cdn-azure.dora.run/ - gopay13.isvn.top [VT:19, status:dead] → https://phishdestroy.io/domain/gopay13.isvn.top/ - gopay24.isvn.top [VT:19, status:dead] → https://phishdestroy.io/domain/gopay24.isvn.top/ - gopay36.vnyn.top [VT:19, status:dead] → https://phishdestroy.io/domain/gopay36.vnyn.top/ - gopay7.vkgh.top [VT:19, status:dead] → https://phishdestroy.io/domain/gopay7.vkgh.top/ - gopay73.vnyn.top [VT:19, status:dead] → https://phishdestroy.io/domain/gopay73.vnyn.top/ - gopay10.dtbu.top [VT:18, status:dead] → https://phishdestroy.io/domain/gopay10.dtbu.top/ - gopay11.isvn.top [VT:18, status:dead] → https://phishdestroy.io/domain/gopay11.isvn.top/ - gopay12.dtbu.top [VT:18, status:dead] → https://phishdestroy.io/domain/gopay12.dtbu.top/ - gopay16.vkgh.top [VT:18, status:dead] → https://phishdestroy.io/domain/gopay16.vkgh.top/ - gopay25.cevc.top [VT:18, status:dead] → https://phishdestroy.io/domain/gopay25.cevc.top/ - gopay30.g31w.xyz [VT:18, status:dead] → https://phishdestroy.io/domain/gopay30.g31w.xyz/ - gopay34.vnyn.top [VT:18, status:dead] → https://phishdestroy.io/domain/gopay34.vnyn.top/ - gopay7.evho.top [VT:18, status:dead] → https://phishdestroy.io/domain/gopay7.evho.top/ - gopay7.isvn.top [VT:18, status:dead] → https://phishdestroy.io/domain/gopay7.isvn.top/ - gopay9.isvn.top [VT:18, status:dead] → https://phishdestroy.io/domain/gopay9.isvn.top/ - midasbuy.fulio.icu [VT:18, status:dead] → https://phishdestroy.io/domain/midasbuy.fulio.icu/ - pancakeswap.asia [VT:18, status:dead] → https://phishdestroy.io/domain/pancakeswap.asia/ - click2prize.com [VT:17, status:dead] → https://phishdestroy.io/domain/click2prize.com/ - gemini-balance.krismile.vip [VT:17, status:dead] → https://phishdestroy.io/domain/gemini-balance.krismile.vip/ - gopay11.dtbu.top [VT:17, status:dead] → https://phishdestroy.io/domain/gopay11.dtbu.top/ - gopay23.cevc.top [VT:17, status:dead] → https://phishdestroy.io/domain/gopay23.cevc.top/ - gopay24.s6h0.xyz [VT:17, status:dead] → https://phishdestroy.io/domain/gopay24.s6h0.xyz/ - gopay24.vkml.top [VT:17, status:dead] → https://phishdestroy.io/domain/gopay24.vkml.top/ - gopay25.ckbe.top [VT:17, status:dead] → https://phishdestroy.io/domain/gopay25.ckbe.top/ - gopay25.yrz1.xyz [VT:17, status:dead] → https://phishdestroy.io/domain/gopay25.yrz1.xyz/ - gopay48.vnyn.top [VT:17, status:dead] → https://phishdestroy.io/domain/gopay48.vnyn.top/ - gopay50.kdti.top [VT:17, status:dead] → https://phishdestroy.io/domain/gopay50.kdti.top/ - gopay61.evho.top [VT:17, status:dead] → https://phishdestroy.io/domain/gopay61.evho.top/ - gopay8.vkml.top [VT:17, status:dead] → https://phishdestroy.io/domain/gopay8.vkml.top/ - trzwallet.com [VT:17, status:dead] → https://phishdestroy.io/domain/trzwallet.com/ - uk.paying-dq.vip [VT:17, status:dead] → https://phishdestroy.io/domain/uk.paying-dq.vip/ - 6261122.com [VT:16, status:dead] → https://phishdestroy.io/domain/6261122.com/ - aa.skinpat.com [VT:16, status:dead] → https://phishdestroy.io/domain/aa.skinpat.com/ - darb.rtarx.com [VT:16, status:dead] → https://phishdestroy.io/domain/darb.rtarx.com/ - email.prod.leadmicpro.com [VT:16, status:dead] → https://phishdestroy.io/domain/email.prod.leadmicpro.com/ - gopay10.owxk.top [VT:16, status:dead] → https://phishdestroy.io/domain/gopay10.owxk.top/ - gopay13.dtbu.top [VT:16, status:dead] → https://phishdestroy.io/domain/gopay13.dtbu.top/ - gopay17.s6h0.xyz [VT:16, status:dead] → https://phishdestroy.io/domain/gopay17.s6h0.xyz/ - gopay30.yrz1.xyz [VT:16, status:dead] → https://phishdestroy.io/domain/gopay30.yrz1.xyz/ ## Links - Full interactive hub: https://phishdestroy.io/domain/?registrar=Alibaba+Cloud+Computing+Ltd.+d%2Fb%2Fa+HiChina+%28www.net.cn%29 - Site-wide LLM feed: https://phishdestroy.io/llms.txt - Report abuse / appeals: https://phishdestroy.io/appeals/