# PhishDestroy threat dossier — ajvcu.cn ================================================================ Fetched: 2026-07-21 10:52:10 UTC Canonical: https://phishdestroy.io/domain/ajvcu.cn/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 5/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Certego, CRDF, Gridinsoft, Netcraft URLQuery: 2 detections AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 156.234.7.18 (HK, Hong Kong) ASN: AS138415 Yancy Limited Hosting org: Yancy Limited Registrar: 成都伊索信息科技有限公司 Nameservers: ns1.julydns.com, ns1.onclouddns.com, ns2.julydns.com, ns2.onclouddns.com Registered: 2025-11-11 Expires: 2026-11-11 Page title: Verifying that you are human... HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-09-19 Status: INVALID chain Fingerprint: 285e6e4bac1b370e11c48b182c79e88c48005d9ec1770a85a7b9f06bee954dac ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2025-11-11 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-20 13:14:54 UTC (by PhishDestroy tracker) First reported: 2026-07-20 11:22:42 UTC (abuse notice filed) Last verified: 2026-07-21 12:27:39 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f7f3b-26bb-76db-9656-0bca1efe5054/ URLQuery: https://urlquery.net/report/3c16d624-beba-497a-a573-cfb469e0e6d5 Wayback Machine: https://web.archive.org/web/*/ajvcu.cn crt.sh CT logs: https://crt.sh/?q=%25.ajvcu.cn Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=ajvcu.cn AlienVault OTX: https://otx.alienvault.com/indicator/domain/ajvcu.cn URLhaus: https://urlhaus.abuse.ch/host/ajvcu.cn/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-20 13:19:13 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] ajvcu.cn Safety Check — Generic Phishing Detected Analysis of ajvcu.cn shows a high‑risk, active phishing infrastructure. The domain was registered on 11 November 2025 by the registrar 成都伊索信息科技有限公司 and currently resolves to the IPv4 address 156.234.7.18. DNS resolution is served by four nameservers – ns1.julydns.com, ns2.julydns.com, ns1.onclouddns.com and ns2.onclouddns.com – suggesting a multi‑provider setup that can aid resilience against takedown attempts. The domain appears on three public blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services, confirming that threat‑intel feeds have identified it as malicious. VirusTotal scans have returned five positive detections out of ninety‑five submitted security engines, providing additional independent confirmation of malicious behavior. While the specific phishing campaign content (page title, targeted brand, or credential‑capture mechanism) has not been disclosed, the combined indicators of recent registration, active DNS, blocklist presence, and multiple vendor detections constitute a robust evidence set that the domain is being used for credential‑stealing or related fraud. Defenders should block network traffic to 156.234.7.18 and enforce DNS filtering for ajvcu.cn across perimeter and endpoint solutions. Security teams should also monitor for related domains that share the same nameserver configuration or exhibit similar registration patterns, and consider adding ajvcu.cn to internal block lists and email‑gateway policies to prevent user exposure. Continuous re‑evaluation is advised in case additional intelligence, such as payload samples or phishing page screenshots, becomes available. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260720-84FF16 Favicon MD5: aee698715b7790c59a995ddb20c8625e TLS cert SHA-256: 285e6e4bac1b370e11c48b182c79e88c48005d9ec1770a85a7b9f06bee954dac ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/ajvcu.cn/ JSON API: https://api.destroy.tools/v1/check?domain=ajvcu.cn Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 187,516 domains (57,527 alive under monitoring, 128,342 confirmed takedowns/dead). Site: https://phishdestroy.io