# PhishDestroy domain threat record: admin.circleburo.kz Content language: English Canonical HTML report: https://phishdestroy.io/domain/admin.circleburo.kz/ Machine-readable companion: https://phishdestroy.io/domain/admin.circleburo.kz/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-03 08:16:15 UTC - Last availability or vendor check: 2026-10-22 10:25:47 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 9/89 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: MetaMask ## Stored infrastructure - Observed IP address: 78.109.18.11 - Registrar in stored WHOIS data: HOSTER.KZ - Last stored HTTP status: 302 - Registration date in stored WHOIS data: 2025-07-17 10:38:04 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/admin.circleburo.kz - Certificate Transparency search: https://crt.sh/?q=%25.admin.circleburo.kz - Web Archive lookup: https://web.archive.org/web/*/https://admin.circleburo.kz/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview admin.circleburo.kz is an impersonation phishing page that presents itself as "Circle Admin", borrowing the Circle name to look like an official management console. It targets crypto users who expect to sign in to a Circle-branded service. PhishDestroy first flagged it on 2026-09-03. As of 2026-10-19 the site was still alive and reachable, now serving a redirect rather than a static page. How the scam works Impersonation pages like this rely on a trusted brand and an official-sounding subdomain. Here the "admin" prefix and the "Circle Admin" title suggest a privileged back-office login. A visitor who believes the panel is genuine is asked to sign in or to link a wallet. Typed credentials go straight to the operators, and a connected wallet can be pushed toward signing transactions that hand over funds. The title points to an administrative login screen, while our classification covers the broader impersonation of the Circle brand. Evidence VirusTotal shows 9 of 89 engines flagging the domain as of 2026-09-14. The flags come from alphaMountain.ai, BitDefender, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, G-Data and Gridinsoft, a spread of independent vendors rather than a single source. Coverage is modest, so many security tools will still let the page load. The domain is also listed by MetaMask and SEAL alongside PhishDestroy. Those crypto-focused blocklists can warn wallet users before they interact with the page. Infrastructure The parent domain was registered on 2025-07-17 through HOSTER.KZ, more than a year before PhishDestroy detected the subdomain. That gap fits a domain that sat quietly or served other content before the Circle-branded panel appeared. It is hosted in Kazakhstan on the Nova Cloud LLP network. Its free Let's Encrypt certificate means the browser padlock says nothing about who runs the site. What to do If you entered a username or password on this panel, change that password at once on the real service and anywhere you reused it. Then turn on app-based two-factor authentication. If you connected a wallet or signed anything, revoke the approvals you granted with a token-approval checker. Move remaining assets to a fresh wallet if you shared a seed phrase. Defenders should block the domain and its subdomains, add it to mail and web filters, and alert staff that no legitimate Circle admin portal lives on this domain. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/admin.circleburo.kz Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=admin.circleburo.kz Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:51:14 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/0f655327-856f-47f1-a61b-b4d47adad1a6.png Captured: 2026-09-13 00:10:50 UTC Source report: https://radar.cloudflare.com/scan/0f655327-856f-47f1-a61b-b4d47adad1a6 SHA-256: 715eea1154d5b2d63a190280dbd75b031c4e3b929e5d6a2fe78965b408b77a83 - URLScan · 2026-09-03: https://screenshots.phishdestroy.io/us/01a06659-a967-72d6-bd9a-37ebd7082fde.png Captured: 2026-09-03 08:19:41 UTC Source report: https://urlscan.io/result/01a06659-a967-72d6-bd9a-37ebd7082fde/ SHA-256: 1076290d14e4b59993c803014faa198a0c0f256477583be8277653ffc905c987 - URLScan · 2026-09-03: https://screenshots.phishdestroy.io/us/01a0665b-0cd3-773f-af2e-e87e315422dd.png Captured: 2026-09-03 08:21:13 UTC Source report: https://urlscan.io/result/01a0665b-0cd3-773f-af2e-e87e315422dd/ SHA-256: 93395f7d9cb2802a53867aa8fda8eef0870a46f7c161fe167bf171df77c7bf38 - URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a113f5-f72f-70ee-9ff2-6cc8c7f24e58.png Captured: 2026-10-07 01:24:15 UTC Source report: https://urlscan.io/result/01a113f5-f72f-70ee-9ff2-6cc8c7f24e58/ SHA-256: aaca6de0c898da115bfa5649c604c0d6cfa297d9d6774bcb5fd475cc58033830 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-21T02:30:34Z", "uuid": "0f655327-856f-47f1-a61b-b4d47adad1a6", "scanned_at": "2026-09-13T00:10:50Z", "final_url": "https://admin.circleburo.kz/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://admin.circleburo.kz/", "status": 307 }, { "url": "https://admin.circleburo.kz/", "status": 200 } ], "dom_hash": "c7b36bf9a0a6d01f8d941a630acd6bb3b9dce0410492fdd79657fc5edbb03aee", "doc_hash": "681c1757bc5556ea790a5d766bcd465a9d598fefacc7a7f1d432e89e973813cd", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "admin.circleburo.kz", "type": "A", "value": "78.109.18.11" } ], "dnssec_valid": false, "ip": "78.109.18.11", "whois": { "registrar": "HOSTER.KZ", "created": "2025-07-17T12:38:04Z", "updated": "2025-12-05T04:46:04Z", "nameservers": [ "corey.ns.cloudflare.com", "opal.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T14:53:01Z", "analysis_at": "2026-10-05T06:41:09Z", "stats": { "timeout": 0, "harmless": 49, "malicious": 7, "suspicious": 2, "undetected": 34 }, "detections": { "CRDF": "malicious", "ESET": "suspicious", "G-Data": "phishing", "CyRadar": "phishing", "SOCRadar": "phishing", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2026-08-28T14:40:03Z", "dns": [ { "ttl": 300, "type": "A", "value": "78.109.18.11" } ], "dns_at": "2026-10-05T07:28:03Z", "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319", "cert": { "san": [ "admin.circleburo.kz" ], "issuer": "Let's Encrypt / YE2", "serial": "65a6e07252c6d6ae0965aaa69f13e69e801", "sha256": "15c01de7a490f97b76770121c604259c5abd3bffb404f8f17b3513509d42fe66", "subject": "admin.circleburo.kz", "valid_to": "2026-11-26T12:50:15Z", "valid_from": "2026-08-28T12:50:16Z" }, "whois": { "status": [ "clientDeleteProhibited" ], "nameservers": [ "corey.ns.cloudflare.com", "opal.ns.cloudflare.com" ] } } } ```