# PhishDestroy domain threat record: breachrbh.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/breachrbh.com/ Machine-readable companion: https://phishdestroy.io/domain/breachrbh.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 08:48:28 UTC - Last availability or vendor check: 2026-10-25 12:23:05 UTC - Stored record updated: 2026-10-25 12:23:05 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: american express ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-10-22 18:51:06 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17247-3947-727f-8468-a1ebb2b84a55/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/breachrbh.com - Certificate Transparency search: https://crt.sh/?q=%25.breachrbh.com - Web Archive lookup: https://web.archive.org/web/*/https://breachrbh.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI classified breachrbh.com as malicious because the site mimics Robinhood and markets a “Breach” token that claims to track whale‑size stock token trades, presenting a “Connect wallet” or “Check” button. The domain was first observed by PhishDestroy on 2026-10-25, three days after its registration on 2026-10-22. How the scam works In this type of scheme the attacker copies a well‑known brand’s look and name to lend credibility, then offers a token or investment that appears exclusive or high‑value. By prompting visitors to connect a crypto wallet, the attacker can request token approvals or transfer permissions, enabling potential fund drainage without any on‑site transaction. Evidence The page title recorded as “Breach — every whale surfaces” and the excerpt describing a “Breach” token on a “Robinhood Chain” match the impersonation concern. VirusTotal scanned the domain on 2026-10-25 with 92 engines and reported zero detections. Google Safe Browsing checked the same day and did not flag the URL. Urlscan captured a clean verdict on 2026-10-23, and OTX listed no pulses. PhishDestroy’s internal blocklist marks the domain as malicious while external blocklists returned no hits. Infrastructure The domain was registered on 2026-10-22 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is protected by Cloudflare’s CDN, resolving to IPv4 188.114.96.3/188.114.97.3 and IPv6 2a06:98c1:3121::3. TLS is provided by a Let’s Encrypt certificate valid until 2027-01-20. The registrar record shows client‑delete and client‑transfer prohibitions, and the hosting network is identified as CloudFLARENET‑EU in Great Britain. What to do Visitors should avoid clicking the “Connect wallet” button and never approve any transaction on the site. Organizations should block breachrbh.com at DNS or proxy level, add it to threat feeds, and review logs for connections to the recorded IP addresses. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1668b-7c24-7445-be8e-c69cbdb2ed1c/ Cloudflare Radar report: https://radar.cloudflare.com/scan/490f660c-059d-4828-b7dc-ba76f8efe27b Stored capture screenshot: https://urlscan.io/screenshots/01a1668b-7c24-7445-be8e-c69cbdb2ed1c.png Cloudflare Radar screenshot (2026-10-25T08:52:33Z): https://screenshots.phishdestroy.io/cf/490f660c-059d-4828-b7dc-ba76f8efe27b.png VirusTotal report: https://www.virustotal.com/gui/domain/breachrbh.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=breachrbh.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 08:56:24 UTC ## Stored page captures - Primary capture: https://i.ibb.co/4ZBcgsTm/e12ef9f31a88.png Captured: 2026-10-25 08:59:20 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a17247-3947-727f-8468-a1ebb2b84a55.png Captured: 2026-10-25 08:59:20 UTC Source report: https://urlscan.io/result/01a17247-3947-727f-8468-a1ebb2b84a55/ - URLScan capture 2: https://urlscan.io/screenshots/01a1668b-7c24-7445-be8e-c69cbdb2ed1c.png Captured: 2026-10-25 08:48:28 UTC Source report: https://urlscan.io/result/01a17247-3947-727f-8468-a1ebb2b84a55/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/490f660c-059d-4828-b7dc-ba76f8efe27b.png Captured: 2026-10-25 08:52:33 UTC Source report: https://radar.cloudflare.com/scan/490f660c-059d-4828-b7dc-ba76f8efe27b SHA-256: 9f1498ca7c78e6659e16cb5551333bca72f3fd8ade0e74fc9411dd3b231c3f95 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T09:16:34Z", "uuid": "01a17247-3947-727f-8468-a1ebb2b84a55", "scanned_at": "2026-10-25T08:57:21Z", "final_url": "https://breachrbh.com/", "status": 200, "ip": "172.67.143.193", "domains": [ "rpc.mainnet.chain.robinhood.com", "fonts.gstatic.com", "static.cloudflareinsights.com", "fonts.googleapis.com" ], "ips": [ "104.20.46.209", "104.16.80.73", "142.251.16.94", "142.250.217.10", "172.67.143.193" ], "asns": [ "13335", "15169" ], "countries": [ "US" ], "link_domains": [ "ponsfamily.com", "robinhoodchain.blockscout.com", "www.sec.gov", "x.com" ], "social": [ "https://x.com/intent/post", "https://x.com/breach_rbh" ], "doc_hash": "38778622720e18d05f13f244a9ffee8d71afb1d74cceca881d9aeee97013e87a", "globals": [ "BREACH_CONFIG", "BREACH_DATA", "changeLabel", "tokenChip", "allocation", "renderBrand", "renderStats", "renderTabs", "renderFund", "renderAlloc", "renderMoves", "renderInsiders", "loadData", "initInsiders", "marketState", "startMarketClock", "seedBreach", "copy", "init", "encodeAggregate3", "decodeAggregate3", "ethCalls", "loadHoldings", "overlap", "renderScore", "check", "connect", "renderVote", "loadResults", "castVote", "chain", "refreshPrices", "classify", "readRange", "markFlippers", "visibleEvents", "renderWhaleStats", "renderWhales", "renderWhaleControls", "pollWhales" ], "tls": { "san": [ "*.breachrbh.com", "breachrbh.com" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "breachrbh.com", "protocol": "QUIC", "valid_to": "2027-01-20T19:56:55Z", "valid_from": "2026-10-22T19:56:56Z" }, "domain_age_days": 2, "apex_age_days": 2, "tls_age_days": 2, "tls_valid_days": 89, "requests": 38, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 96, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html", "x-powered-by": "PleskLin" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T08:55:06Z", "uuid": "490f660c-059d-4828-b7dc-ba76f8efe27b", "scanned_at": "2026-10-25T08:52:33Z", "final_url": "https://breachrbh.com/", "status": 200, "history": [ { "url": "https://breachrbh.com/", "status": 200 } ], "dom_hash": "54f5ad9c3bd99b50b66490def235ad4c5e1cba97d7b39eda7a95f2a6a5694c05", "doc_hash": "38778622720e18d05f13f244a9ffee8d71afb1d74cceca881d9aeee97013e87a", "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "breachrbh.com", "type": "A", "value": "104.21.55.2" }, { "name": "breachrbh.com", "type": "A", "value": "172.67.143.193" }, { "name": "breachrbh.com", "type": "AAAA", "value": "2606:4700:3033::6815:3702" }, { "name": "breachrbh.com", "type": "AAAA", "value": "2606:4700:3034::ac43:8fc1" } ], "dnssec_valid": false, "ip": "104.21.55.2", "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-22T20:51:06Z", "updated": "2026-10-22T20:51:07Z", "expires": "2027-10-22T20:51:06Z", "nameservers": [ "archer.ns.cloudflare.com", "zainab.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T08:51:37Z", "analysis_at": "2026-10-25T08:36:15Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-22T20:51:07Z", "expires": "2027-10-22T20:51:06Z", "updated": "2026-10-22T20:51:07Z", "first_seen": "2026-10-22T21:01:28Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "archer.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.143.193" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::6815:3702" }, { "ttl": 300, "type": "A", "value": "104.21.55.2" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::ac43:8fc1" }, { "ttl": 21600, "type": "NS", "value": "archer.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "zainab.ns.cloudflare.com" } ], "dns_at": "2026-10-25T08:48:53Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.breachrbh.com", "breachrbh.com" ], "issuer": "Let's Encrypt / YE1", "serial": "63d647d576aa1763423815cc925d21387cf", "sha256": "52c1de6c1de7d8cecd621d84dfc7e6223ebea4d341043a350bc0230137a12bc6", "subject": "breachrbh.com", "valid_to": "2027-01-20T19:56:55Z", "valid_from": "2026-10-22T19:56:56Z" }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765", "registrar_url": "https://nicenic.com", "created": "2026-10-22T20:51:06Z", "updated": "2026-10-22T20:51:07Z", "expires": "2027-10-22T20:51:06Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "archer.ns.cloudflare.com", "zainab.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2027-10-22T20:51:06Z", "registration": "2026-10-22T20:51:07Z", "registrar expiration": "2027-10-22T20:51:06Z", "last update of RDAP database": "2026-10-22T20:51:07Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T08:55:28Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "breachrbh.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-25T08:49:18Z", "first": "2026-10-25T08:49:18Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 139630 }, "social_tags": { "title": "Breach — every whale surfaces", "ogTitle": "Breach — every whale surfaces", "description": "Breach watches Robinhood Chain and the SEC at once: every whale-size stock token trade the second it lands, and every CEO buy the day it is filed.", "twitterCard": "summary", "ogDescription": "Live whale trades of stock tokens on Robinhood Chain, plus insider and fund filings from the SEC." }, "trackers": { "requests": 6, "trackers": [ { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 14, "tls": 63, "wait": 152, "connect": 6, "download": 119 }, "response_ms": 354 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 398515, "co2_grams": 0.0146, "cleaner_than": 1 }, "dns_server": { "ns": [ { "ip": "162.159.44.136", "host": "archer.ns.cloudflare.com" }, { "ip": "162.159.38.149", "host": "zainab.ns.cloudflare.com" } ], "zone": "breachrbh.com" }, "location": { "ip": "2a06:98c1:3121::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "breachrbh.com" }, "dns": { "A": [ "188.114.96.3", "188.114.97.3" ], "NS": [ "archer.ns.cloudflare.com", "zainab.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"archer.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418391231, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3121::3", "2a06:98c1:3120::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::3", "family": 6 }, "redirects": { "chain": [ "https://breachrbh.com" ] }, "subdomains": { "count": 1, "subdomains": [ "www.breachrbh.com" ] }, "linked_pages": { "internal_count": 6 }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-22T20:51:06Z", "updated": "2026-10-22T20:51:07Z", "expires": "2027-10-22T20:51:06Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "archer.ns.cloudflare.com", "zainab.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html", "x-powered-by": "PleskLin" } } } } ```