# PhishDestroy threat dossier — accept-everyworld.pages.dev ================================================================ Fetched: 2026-05-03 12:42:10 UTC Canonical: https://phishdestroy.io/domain/accept-everyworld.pages.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 3/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, G-Data, Sophos Public blocklists: listed on 2 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: Cloudflare, Inc. Nameservers: kenia.ns.cloudflare.com, roan.ns.cloudflare.com Registered: 2026-04-26 Page title: Everyworld HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-06-14 Status: INVALID chain Fingerprint: f9a8dfc8fba0f4a972f84c6aa80bb6db7f91d2ade828363322122535214b1ce8 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-26 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-26 15:54:56 UTC (by PhishDestroy tracker) Last verified: 2026-04-28 22:14:03 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dc9d9-96fc-70d7-a6e8-a994444eda0f/ Wayback Machine: https://web.archive.org/web/*/accept-everyworld.pages.dev crt.sh CT logs: https://crt.sh/?q=%25.accept-everyworld.pages.dev Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=accept-everyworld.pages.dev AlienVault OTX: https://otx.alienvault.com/indicator/domain/accept-everyworld.pages.dev URLhaus: https://urlhaus.abuse.ch/host/accept-everyworld.pages.dev/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-26 15:56:41 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies the active phishing domain accept-everyworld.pages.dev as a generic crypto drainer targeting cryptocurrency users. This threat is designed to silently drain digital assets from victims’ wallets upon interaction, leveraging deceptive landing pages to mimic legitimate services. While the exact brand impersonated remains unverified, the domain’s structure suggests opportunistic attacks rather than a targeted brand campaign. The strain of drainer kit deployed is consistent with open-source or commodity malware families observed in recent campaigns, prioritizing ease of deployment over sophistication. This domain was flagged with the following technical indicators: VirusTotal currently scores it at 0/95 detections, indicating no antivirus or security vendor has yet flagged its payload. It resolves to IP 188.114.97.3 via Cloudflare, Inc., and holds a valid SSL certificate issued by Google Trust Services. The domain was registered through Cloudflare’s registrar services, which may obfuscate ownership details. Notably, it appears on 2 public security blocklists and remains unflagged by Google Safe Browsing (GSB) as of this report. These characteristics suggest an actively evolving but still under-the-radar threat actor operating with moderate operational security. As of this analysis, accept-everyworld.pages.dev remains active and under active threat investigation. It has been blocked by ScamSniffer and Enkrypt, two specialized anti-scam platforms, but has not yet been widely recognized by mainstream security vendors. The absence of detections on VirusTotal and GSB indicates a window of opportunity for propagation before broader mitigation occurs. PhishDestroy advises users to avoid interacting with this domain entirely and to verify all crypto-related links through trusted sources. Organizations are encouraged to monitor network traffic for connections to 188.114.97.3 and to update browser-based blocklists accordingly. While the immediate risk is classified as active but under investigation, the lack of early detection mechanisms elevates the potential for widespread victimization before full containment. [Updates since narrative was generated:] - VirusTotal detections: now 3/91 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 2d0415c966f0d1370063c9a6b9f6132e TLS cert SHA-256: f9a8dfc8fba0f4a972f84c6aa80bb6db7f91d2ade828363322122535214b1ce8 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/accept-everyworld.pages.dev/ JSON API: https://api.destroy.tools/v1/check?domain=accept-everyworld.pages.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 145,105 domains (55,994 alive under monitoring, 88,742 confirmed takedowns/dead). Site: https://phishdestroy.io