# PhishDestroy threat dossier — almaz-savchenko.com ================================================================ Fetched: 2026-07-29 18:36:10 UTC Canonical: https://phishdestroy.io/domain/almaz-savchenko.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 93/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/91 security vendors flagged this domain Flagging vendors: Gridinsoft, SOCRadar AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 213.130.74.19 (BG, Sofia) ASN: AS201993 Tilda Publishing Kaz LLC Hosting org: Tilda Publishing Kaz LLC Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com Nameservers: ns1.unihost.kz, ns2.unihost.kz Registered: 2026-06-09 Expires: 2027-06-09 Page title: Алмаз Савченко HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YE1 Expires: 2026-09-08 Status: INVALID chain Fingerprint: 020a24e6483a1323636a8e3a87313b8e699ef1e464f5e9a0ceeb8254ec0e2eb5 Subject Alternative Names (related infrastructure — often same operator): - www.almaz-savchenko.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-09 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-17 11:11:09 UTC (by PhishDestroy tracker) First reported: 2026-07-17 09:56:40 UTC (abuse notice filed) Last verified: 2026-07-29 16:20:33 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f6f56-c519-715a-8ec3-e3db950ce7d3/ URLQuery: https://urlquery.net/report/7e76dbba-fc73-4c30-84ac-009bf56d9843 Wayback Machine: https://web.archive.org/web/*/almaz-savchenko.com crt.sh CT logs: https://crt.sh/?q=%25.almaz-savchenko.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=almaz-savchenko.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/almaz-savchenko.com URLhaus: https://urlhaus.abuse.ch/host/almaz-savchenko.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-17 11:20:22 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] almaz-savchenko.com Phishing Site – Active The domain almaz-savchenko.com was registered on June 09, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. Its authoritative nameservers are ns1.unihost.kz and ns2.unihost.kz, and DNS resolution returns the IPv4 address 213.130.74.19. The domain is currently active and has been classified as a generic_phishing infrastructure under investigation. No publicly available page content, page title, or brand targeting information has been disclosed, so the exact phishing payload or victim lure remains uncertain. The recent registration date and rapid activation suggest a purpose-built campaign rather than long‑term abuse. Defenders should consider adding the domain and its resolved IP to block lists, monitoring outbound DNS queries for the associated nameservers, and applying network‑level controls to prevent connections to 213.130.74.19. Continuous threat‑intel feeds should be consulted for any future observations of malicious activity originating from this host. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260717-BED109 Favicon MD5: 365925fce33d344b1cf881d4273cbfb8 TLS cert SHA-256: 020a24e6483a1323636a8e3a87313b8e699ef1e464f5e9a0ceeb8254ec0e2eb5 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/almaz-savchenko.com/ JSON API: https://api.destroy.tools/v1/check?domain=almaz-savchenko.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,500 domains (83,267 alive under monitoring, 109,716 confirmed takedowns/dead). Site: https://phishdestroy.io