# PhishDestroy domain threat record: bestdev5649.github.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bestdev5649.github.io/
Machine-readable companion: https://phishdestroy.io/domain/bestdev5649.github.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-15 14:02:04 UTC
- Last availability or vendor check: 2026-10-21 01:14:29 UTC
- Stored record updated: 2026-10-22 14:21:11 UTC
- VirusTotal detections in the stored snapshot: 11/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: trustwallet

## Stored infrastructure

- Observed IP address: 185.199.108.153
- Registrar in stored WHOIS data: GitHub Pages
- Last stored HTTP status: 404
- Registration date (registry RDAP, github.io): 2013-03-08 19:12:48 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0a528-2c9c-70f8-968e-06bd893b29a2/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bestdev5649.github.io
- Certificate Transparency search: https://crt.sh/?q=%25.bestdev5649.github.io
- Web Archive lookup: https://web.archive.org/web/*/https://bestdev5649.github.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
bestdev5649.github.io is an impersonation phishing page that copies Trust Wallet. Its title, "Trust Wallet - Send USDT", shows it was built for people holding stablecoins in that wallet. PhishDestroy first flagged it on 2026-09-15. The site has been offline since 2026-09-16 and was still dead at the last check on 2026-10-19, with nothing served at its root.

How the scam works
The page poses as Trust Wallet's screen for sending USDT. Victims usually reach it through a link promising a transfer, refund, airdrop or account verification. Fake send screens like this push the visitor into one of two actions. The first is typing in a recovery phrase or private key, which lets the operator empty the wallet from anywhere. The second is connecting a wallet and signing a request that hands token-spending rights to the attacker. Either way, the USDT and any other assets the wallet can reach are at risk, and on-chain transfers cannot be reversed.

Evidence
Several independent sources agree. VirusTotal had 11 of 89 engines flagging the site on 2026-09-17, among them BitDefender, ESET, Kaspersky, Fortinet, Forcepoint ThreatSeeker, G-Data, Gridinsoft and alphaMountain.ai. Several major antivirus vendors listed it within two days of discovery. urlscan.io rated the page malicious and matched it to the Trust Wallet brand, which fits our impersonation classification. The domain is also on the PhishDestroy blocklist.

Infrastructure
The site was a free GitHub Pages subdomain, not a registered domain. Fake pages like this cost nothing to set up and are easy to swap for a new one. Traffic was served through Fastly's network in the US, the standard delivery setup for GitHub Pages. The page went dark one day after PhishDestroy first saw it, so it stayed live only briefly.

What to do
If you entered your Trust Wallet recovery phrase or private key on this page, treat the wallet as compromised. Create a new wallet with a fresh phrase on a clean device and move any remaining funds there right away. If you connected a wallet or signed anything, review and revoke token approvals with a reputable approval checker, starting with USDT. Never type a recovery phrase into a website, since Trust Wallet does not ask for one to send funds. Security teams should block github.io subpaths that imitate wallet brands and watch for new GitHub Pages sites carrying Trust Wallet titles.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0a528-2c9c-70f8-968e-06bd893b29a2/
VirusTotal report: https://www.virustotal.com/gui/domain/bestdev5649.github.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bestdev5649.github.io
Archived copy: https://web.archive.org/web/20260915140311/https://bestdev5649.github.io/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:18:16 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0a528-2c9c-70f8-968e-06bd893b29a2.png
  Captured: 2026-09-15 14:02:04 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/8768ea63-71b3-4a1c-9a4b-2405c8a3fcd4.png
  Captured: 2026-09-15 14:04:56 UTC
  Source report: https://radar.cloudflare.com/scan/8768ea63-71b3-4a1c-9a4b-2405c8a3fcd4
  SHA-256: 171d53e769c62ad46fd23efd39a2c7be3dac146ab56a95b47212aeff3931a99f
- URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a565-e4c8-74c2-8ea5-4babf27178fd.png
  Captured: 2026-09-15 14:08:38 UTC
  Source report: https://urlscan.io/result/01a0a565-e4c8-74c2-8ea5-4babf27178fd/
  SHA-256: dc9b3e0969d94fc38aa516c6cec2c01fa696bceb892af69b4a3c7d5359e99156
- URLScan · 2026-09-19: https://screenshots.phishdestroy.io/us/01a0bb21-469d-75fa-a293-ee16aac44e1a.png
  Captured: 2026-09-19 19:25:21 UTC
  Source report: https://urlscan.io/result/01a0bb21-469d-75fa-a293-ee16aac44e1a/
  SHA-256: 6f8cf461abf6f0981fbdf94a9989850c5ea3b679650ebe74f85399fed3922ea9
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cc1c-ef8b-744b-b300-f55bf60b9f48.png
  Captured: 2026-09-23 02:34:10 UTC
  Source report: https://urlscan.io/result/01a0cc1c-ef8b-744b-b300-f55bf60b9f48/
  SHA-256: 6f8cf461abf6f0981fbdf94a9989850c5ea3b679650ebe74f85399fed3922ea9
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e3cb-ce47-73f0-9e38-f6564a431a03.png
  Captured: 2026-09-27 16:56:25 UTC
  Source report: https://urlscan.io/result/01a0e3cb-ce47-73f0-9e38-f6564a431a03/
  SHA-256: 6f8cf461abf6f0981fbdf94a9989850c5ea3b679650ebe74f85399fed3922ea9

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:12:34Z",
        "uuid": "01a0a528-2c9c-70f8-968e-06bd893b29a2",
        "scanned_at": "2026-09-15T13:01:15Z",
        "final_url": "https://bestdev5649.github.io/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://bestdev5649.github.io/",
                "from": "http://bestdev5649.github.io/",
                "status": 307
            }
        ],
        "ip": "2606:50c0:8001::153",
        "domains": [
            "cdn.jsdelivr.net"
        ],
        "ips": [
            "2606:4700::6811:cf05",
            "2606:50c0:8001::153"
        ],
        "asns": [
            "13335",
            "54113"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "ba82f8b0ecf3ddebfe86b42f6844d5a4fdce6aebdbaeb56deacb36ae733995a7",
        "globals": [
            "axios",
            "_0x4129",
            "sendTelegramMessage",
            "_0x4981",
            "setStatus",
            "tronRpcPost",
            "getChainParametersReadOnly",
            "obtenerBalanceSeguro",
            "estimarFeeRed",
            "checkWalletOnLoad",
            "_0x147383",
            "USDT_ABI",
            "USDT_ADDRESS",
            "BILLETERA_DESTINO",
            "CONTRACT_USDT",
            "connectBtn",
            "statusDiv",
            "amountDisplay",
            "addressDisplay",
            "usdtDisplay",
            "depositDisplay",
            "approveBtn",
            "maxAction",
            "maxActionLabel",
            "amountInputContent",
            "feeInfo",
            "feeDisplay",
            "walletAddress",
            "TRON_READ_RPC",
            "TRON_API_KEY"
        ],
        "tls": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "*.github.io",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-31T23:38:01Z",
            "valid_from": "2026-08-02T23:38:02Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 43,
        "tls_valid_days": 89,
        "requests": 3,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "trustwallet"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Trustwallet"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "GitHub.com",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31556952"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:24:14Z",
        "uuid": "8768ea63-71b3-4a1c-9a4b-2405c8a3fcd4",
        "scanned_at": "2026-09-15T14:04:56Z",
        "final_url": "https://bestdev5649.github.io/",
        "status": 200,
        "history": [
            {
                "url": "https://bestdev5649.github.io/",
                "status": 200
            }
        ],
        "dom_hash": "cdec3e320f26a9117716c36f748ee6922744099252ec9bdfacf582c1e7539227",
        "doc_hash": "ba82f8b0ecf3ddebfe86b42f6844d5a4fdce6aebdbaeb56deacb36ae733995a7",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "bestdev5649.github.io",
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "name": "bestdev5649.github.io",
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "name": "bestdev5649.github.io",
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "name": "bestdev5649.github.io",
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "name": "bestdev5649.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            },
            {
                "name": "bestdev5649.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "name": "bestdev5649.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "name": "bestdev5649.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.199.109.153",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2026-08-12T09:08:04Z",
            "expires": "2027-03-08T19:12:48Z",
            "nameservers": [
                "ns-692.awsdns-22.net",
                "ns-1622.awsdns-10.co.uk",
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T10:31:23Z",
        "analysis_at": "2026-10-12T17:54:14Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 13,
            "suspicious": 0,
            "undetected": 34
        },
        "detections": {
            "ESET": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "Kaspersky": "phishing",
            "Gridinsoft": "phishing",
            "MalwareURL": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "Google": "technology",
            "Sophos": "phishing and fraud",
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "information technology"
        },
        "registrar": "MarkMonitor Inc.",
        "created": "2013-03-08T19:41:10Z",
        "expires": "2027-03-08T19:12:48Z",
        "updated": "2026-08-12T09:08:04Z",
        "first_seen": "2026-09-14T03:53:08Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            }
        ],
        "dns_at": "2026-10-12T17:59:37Z",
        "jarm": "29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c",
        "cert": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "59e7c420f8943f524ab370807c836bb57fe",
            "sha256": "71f1077db377fd7b8d68380da66fa68238a303b2911bcb770b3b2a426693cf84",
            "subject": "*.github.io",
            "valid_to": "2026-10-31T23:38:01Z",
            "valid_from": "2026-08-02T23:38:02Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2025-02-25T20:53:31Z",
            "expires": "2027-03-08T00:00:00Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net",
                "ns-1622.awsdns-10.co.uk",
                "ns-692.awsdns-22.net"
            ],
            "dnssec": "unsigned"
        }
    }
}
```