# PhishDestroy threat dossier — about.npr.org
================================================================

Fetched:   2026-07-24 15:07:40 UTC
Canonical: https://phishdestroy.io/domain/about.npr.org/

## VERDICT
----------------------------------------------------------------
ACTIVE THREAT — multiple warning signs
Composite threat score: 45/100 (PhishDestroy scoring — see methodology below)

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      0/91 security vendors flagged this domain
Public blocklists: listed on 1 independent blocklist

## INFRASTRUCTURE
----------------------------------------------------------------
Registrar:       MarkMonitor Inc.
Nameservers:     ["ns-1227.awsdns-25.org", "ns-139.awsdns-17.com", "ns-1580.awsdns-05.co.uk", "ns-769.awsdns-32.net"]
HTTP response:   301

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: pending notification queue. No abuse reports filed yet — this domain is
waiting for the next cycle of our automated abuse-reporter.

## TIMELINE
----------------------------------------------------------------
First detected:    2026-07-19 13:00:16 UTC (by PhishDestroy tracker)
Last verified:     2026-07-24 16:20:24 UTC
Current status:    ACTIVE / observable

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-07-19 21:05:56 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

about.npr.org Under Investigation for Potential Threat

about.npr.org is currently flagged for generic phishing activity and remains under investigation as of July 19, 2026. The domain has been blocked by PhishDestroy and is present on one security blocklist, which indicates it has triggered at least some automated defenses. VirusTotal scans across 91 vendors presently show no detections, but this absence of findings is not confirmation of safety. The domain remains active and is configured to return an HTTP 301 status, which can suggest redirection behavior often associated with phishing infrastructure, though this alone is not definitive. There is no available intelligence concerning the specific content or the targeted brand or service; the exact nature of the threat posed by about.npr.org has not yet been confirmed through direct analysis of the site itself. Defenders are advised to monitor this domain for new evidence, maintain updated blocklists, and treat any traffic or interaction with about.npr.org as potentially suspicious until further investigation clarifies its purpose. At present, caution is warranted and incident responders should prioritize review of any logs or reports mentioning this domain.

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (operator takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/about.npr.org/
JSON API:          https://api.destroy.tools/v1/check?domain=about.npr.org
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: independent open-source threat-intelligence platform.
Tracked: 189,335 domains (58,556 alive under monitoring, 129,180 confirmed takedowns/dead). Site: https://phishdestroy.io