# PhishDestroy threat dossier — atlaspro-ontv.pro ================================================================ Fetched: 2026-07-14 05:14:27 UTC Canonical: https://phishdestroy.io/domain/atlaspro-ontv.pro/ ## VERDICT ---------------------------------------------------------------- HIGH THREAT — malicious activity confirmed Composite threat score: 73/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 185.66.141.41 (NL, Amsterdam) ASN: AS200514 KnownSRV Ltd. Hosting org: KnownSRV Ltd. Registrar: OVH SAS Nameservers: ns15.knownsrv.com, ns16.knownsrv.com Registered: 2025-11-21 Expires: 2026-11-21 Page title: Atlas Pro ONTV officiel | Prix, installation et support HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-09-20 Status: INVALID chain Fingerprint: 92dde70638f548a281a0e25aa437cadb95c6fba5b4cdd4fbab3713bd8f5d3546 Subject Alternative Names (related infrastructure — often same operator): - atlaspro-ontv.pro.atlasproontvofficiel.fr - www.atlaspro-ontv.pro.atlasproontvofficiel.fr ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2025-11-21 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-12 17:44:28 UTC (by PhishDestroy tracker) First reported: 2026-07-12 17:19:48 UTC (abuse notice filed) Last verified: 2026-07-14 06:45:45 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f56ff-f49b-71be-a79b-328576d08a3d/ URLQuery: https://urlquery.net/report/272e0645-9ef7-4f66-a2f2-a67fcde2fe55 Wayback Machine: https://web.archive.org/web/*/atlaspro-ontv.pro crt.sh CT logs: https://crt.sh/?q=%25.atlaspro-ontv.pro Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=atlaspro-ontv.pro AlienVault OTX: https://otx.alienvault.com/indicator/domain/atlaspro-ontv.pro URLhaus: https://urlhaus.abuse.ch/host/atlaspro-ontv.pro/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-12 17:47:08 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] The domain atlaspro-ontv.pro was registered on 21 November 2025 through OVH SAS. The registration date places the domain well within the typical lifecycle of recent phishing infrastructure, allowing sufficient time for the operator to establish supporting services. The registrar information is publicly visible and points to a major European hosting provider, which is commonly used by threat actors to leverage reputable network infrastructure. DNS resolution for the domain uses the authoritative name servers ns15.knownsrv.com and ns16.knownsrv.com, both of which are publicly resolvable and hosted by the same provider. Current A‑record queries return the IPv4 address 185.66.141.41. No additional records such as MX or TXT were observed at the time of analysis, suggesting a minimalistic configuration typical of domains used solely to host malicious landing pages. VirusTotal has not flagged any of the 95 submitted samples associated with this domain, indicating that the site has either not been widely shared or that detection signatures have not yet been generated. The absence of detections does not imply benign behavior; the domain is classified as a generic phishing campaign based on its naming pattern and infrastructure profile. The risk level is marked as under investigation, and the domain remains active as of the report date. Defenders should treat atlaspro-ontv.pro as a potentially malicious indicator. Network security controls ought to block outbound connections to 185.66.141.41 and to the associated name servers. Email security gateways should add the domain to blocklists for credential‑phishing attempts, and SOC teams should monitor DNS logs for queries to the identified name servers. Continuous re‑assessment is recommended, as new samples or detection signatures may emerge. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260712-BB2C82 Favicon MD5: 160b425b4b8e489558bc97e4eda062c7 TLS cert SHA-256: 92dde70638f548a281a0e25aa437cadb95c6fba5b4cdd4fbab3713bd8f5d3546 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/atlaspro-ontv.pro/ JSON API: https://api.destroy.tools/v1/check?domain=atlaspro-ontv.pro Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 178,335 domains (50,012 alive under monitoring, 128,323 confirmed takedowns/dead). Site: https://phishdestroy.io