# PhishDestroy domain threat record: allyouhavetodoisbelieve.fun Content language: English Canonical HTML report: https://phishdestroy.io/domain/allyouhavetodoisbelieve.fun/ Machine-readable companion: https://phishdestroy.io/domain/allyouhavetodoisbelieve.fun/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-04 16:40:09 UTC - Last availability or vendor check: 2026-10-23 01:00:26 UTC - Stored record updated: 2026-10-24 06:20:32 UTC - VirusTotal detections in the stored snapshot: 9/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Registrar in stored WHOIS data: Name.com, Inc. ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/allyouhavetodoisbelieve.fun - Certificate Transparency search: https://crt.sh/?q=%25.allyouhavetodoisbelieve.fun - Web Archive lookup: https://web.archive.org/web/*/https://allyouhavetodoisbelieve.fun/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview allyouhavetodoisbelieve.fun is a domain on the PhishDestroy blocklist. Its slogan-style name refers to no wallet, exchange or project, so it does not openly impersonate any known brand. PhishDestroy first saw it on 2026-09-04. The site has been offline since 2026-09-13, and a check on 2026-10-19 found that its DNS no longer resolves. How the scam works PhishDestroy has not assigned this domain to a specific scheme, and there is no surviving page title or content that shows exactly what it offered. The outside verdicts do agree on one point: Spamhaus lists it as a phishing domain, and several security vendors flag it as malicious. In practice that means a page built to trick visitors into handing over something valuable, such as login credentials, personal details, a wallet recovery phrase or a signed transaction. Anything typed or approved on such a page should be treated as exposed. Evidence On 2026-09-13, VirusTotal showed 9 of 89 engines flagging the domain. They include alphaMountain.ai, BitDefender, CRDF, Fortinet, G-Data, Kaspersky, PhishFort and SOCRadar, and PhishFort specializes in phishing and brand-abuse detection. That is a minority of engines, but the detections come from vendors that run their own analysis. Spamhaus DBL independently classifies the domain under its phishing category, DBL_PHISH. The domain also appears in two AlienVault OTX threat pulses, which shows other researchers have tracked it. Infrastructure The site lasted only about nine days between PhishDestroy's first sighting and its going offline. A short lifespan like this fits throwaway domains that are abandoned once blocklists catch up. It sits on the low-cost .fun top-level domain. Its DNS is now inactive, so the address currently leads nowhere. What to do If you visited this domain and entered a password, change it everywhere you reused it and turn on two-factor authentication. If you connected a crypto wallet or signed anything there, review and revoke token approvals with a trusted approval checker. If you typed in a seed phrase, move your funds to a new wallet immediately. Defenders should keep the domain blocked at DNS and proxy level and search logs from around 2026-09-04 to 2026-09-13 for users who reached it. Because the domain could be re-registered or reactivated, it should stay on watchlists. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/allyouhavetodoisbelieve.fun Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=allyouhavetodoisbelieve.fun Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 11:03:46 UTC ## Stored page captures - URLScan ยท 2026-09-03: https://screenshots.phishdestroy.io/us/01a06907-f8ec-77ca-ba99-675eeb504538.png Captured: 2026-09-03 20:48:57 UTC Source report: https://urlscan.io/result/01a06907-f8ec-77ca-ba99-675eeb504538/ SHA-256: 8283e3efdbed1e54ab8bb9e76d2345e476fc09ade365943d457631ecb41d80c3 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-21T00:27:43Z", "uuid": "f4eeedc7-0cfa-4cf0-bdc0-b9fdbc93c74f", "scanned_at": "2026-09-13T04:16:25Z" }, "vt": { "v": 1, "fetched_at": "2026-10-22T14:52:32Z", "analysis_at": "2026-10-12T09:14:06Z", "stats": { "timeout": 0, "harmless": 46, "malicious": 10, "suspicious": 1, "undetected": 35 }, "detections": { "CRDF": "malicious", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Fortinet": "spam", "SOCRadar": "phishing", "PhishFort": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "Name.com, Inc.", "created": "2026-09-03T19:59:24Z", "expires": "2027-09-03T19:59:24Z", "updated": "2026-09-03T19:59:24Z", "first_seen": "2026-09-03T20:45:22Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "ns1.vercel-dns.com" }, { "ttl": 3600, "type": "SOA", "rname": "hostmaster.nsone.net", "value": "ns1.vercel-dns.com" }, { "ttl": 60, "type": "CAA", "value": "sectigo.com" }, { "ttl": 60, "type": "CAA", "value": "pki.goog" }, { "ttl": 1800, "type": "A", "value": "216.150.16.1" }, { "ttl": 1800, "type": "A", "value": "216.150.16.129" }, { "ttl": 60, "type": "CAA", "value": "letsencrypt.org" }, { "ttl": 21600, "type": "NS", "value": "ns2.vercel-dns.com" } ], "dns_at": "2026-09-04T11:21:01Z", "jarm": "3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fb", "cert": { "san": [ "allyouhavetodoisbelieve.fun" ], "issuer": "Let's Encrypt / YR1", "serial": "591ddee59b1367e8f99bdf2460b145176d7", "sha256": "35298639b9ceaadc292ff92182c246e7f032954bb81e62afd99646787c318fb0", "subject": "allyouhavetodoisbelieve.fun", "valid_to": "2026-12-02T19:06:52Z", "valid_from": "2026-09-03T19:06:53Z" }, "whois": { "registrar": "Name.com, Inc.", "registrar_iana_id": "625", "registrar_url": "https://www.name.com", "created": "2026-09-03T19:59:24Z", "updated": "2026-09-03T19:59:24Z", "expires": "2027-09-03T19:59:24Z", "status": [ "addPeriod", "clientTransferProhibited" ], "nameservers": [ "ns1.vercel-dns.com", "ns2.vercel-dns.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-09-03T19:59:24Z", "last changed": "2026-09-08T20:00:39Z", "registration": "2026-09-03T19:59:24Z", "registrar expiration": "2027-09-03T19:59:24Z", "last update of RDAP database": "2026-09-08T20:00:39Z" } } } } ```