# PhishDestroy domain threat record: btc024.33113.cc

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/btc024.33113.cc/
Machine-readable companion: https://phishdestroy.io/domain/btc024.33113.cc/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 17:31:54 UTC
- Last availability or vendor check: 2026-10-23 17:31:54 UTC
- Stored record updated: 2026-10-23 18:30:15 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.46.49
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date (registry RDAP, 33113.cc): 2014-04-23 11:42:33 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a169d0-5ef4-764a-9f51-4accdc3102ff/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/btc024.33113.cc
- Certificate Transparency search: https://crt.sh/?q=%25.btc024.33113.cc
- Web Archive lookup: https://web.archive.org/web/*/https://btc024.33113.cc/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added btc024.33113.cc to its internal blocklist on 2026-10-23 after an intake rule marked the report as trusted. The prior AI assessment noted that the page needs JavaScript to render, so its content could not be evaluated and the verdict was recorded as unknown. An HTTP request on the same day returned a 200 status code, while Google Safe Browsing reported no flag and OTX showed no pulses.

How the scam works
The domain is flagged by several security engines as phishing or malicious, a category that typically involves presenting counterfeit login or payment interfaces to harvest credentials or trick users. Because the page content could not be captured, no specific technique (such as credential harvesting or wallet prompting) can be confirmed for this site. The classification therefore reflects the risk associated with the observed detections rather than a proven on‑page behavior.

Evidence
VirusTotal scanned the domain on 2026-10-23 and recorded 15 detections from 92 engines, with 14 labeled malicious and 1 suspicious; vendors include BitDefender, ESET, Fortinet and others. URLScan’s engine score was 71 and marked the site as malicious, though its overall verdict was non‑malicious. Cloudflare Radar identified the domain as phishing and assigned a malicious tag. PhishDestroy’s own blocklist marks the domain as internal, while external blocklists returned zero hits on the check date. Google Safe Browsing returned false and OTX reported zero pulses.

Infrastructure
The domain was created 235 days ago and the apex 308 days ago; TLS was issued 13 days ago by Google Trust Services and is valid until 2027-01-08. Hosting is provided through Cloudflare, with recorded IPs 104.21.46.49 (CA) and 172.67.223.221, and nameservers meadow.ns.cloudflare.com and sergi.ns.cloudflare.com. No DNSSEC signatures were present.

What to do
Visitors should avoid entering any credentials, wallet approvals or personal data on the site; if such information was submitted, change passwords and monitor associated accounts. Security teams can block the exact domain and its recorded IPs, log any DNS queries to btc024.33113.cc, and apply the PhishDestroy blocklist indicator to prevent future access. No broader action against the CDN or registrar is required, as the evidence pertains only to this specific domain.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a169d0-5ef4-764a-9f51-4accdc3102ff/
Cloudflare Radar report: https://radar.cloudflare.com/scan/cce6fd40-fd72-435e-b900-24868021a23e
URLQuery report: https://urlquery.net/report/575bbd66-3b10-4342-8285-9884b12eefba
Stored capture screenshot: https://i.ibb.co/V0nqBktZ/52da91a165dc.png
Cloudflare Radar screenshot (2026-10-23T18:04:23Z): https://screenshots.phishdestroy.io/cf/cce6fd40-fd72-435e-b900-24868021a23e.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/575bbd66-3b10-4342-8285-9884b12eefba.png
URLScan screenshot (2026-10-23T17:05:01Z): https://screenshots.phishdestroy.io/us/01a169b9-02da-72ee-a87f-a8a52df6c6f8.png
URLScan capture report: https://urlscan.io/result/01a169b9-02da-72ee-a87f-a8a52df6c6f8/
URLScan screenshot (2026-10-23T17:08:43Z): https://screenshots.phishdestroy.io/us/01a169ba-ab6f-764e-8760-332381985049.png
URLScan capture report: https://urlscan.io/result/01a169ba-ab6f-764e-8760-332381985049/
VirusTotal report: https://www.virustotal.com/gui/domain/btc024.33113.cc
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=btc024.33113.cc
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 18:05:33 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/V0nqBktZ/52da91a165dc.png
  Captured: 2026-10-23 17:31:54 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a169d0-5ef4-764a-9f51-4accdc3102ff.png
  Captured: 2026-10-23 17:31:54 UTC
  Source report: https://urlscan.io/result/01a169d0-5ef4-764a-9f51-4accdc3102ff/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/cce6fd40-fd72-435e-b900-24868021a23e.png
  Captured: 2026-10-23 18:04:23 UTC
  Source report: https://radar.cloudflare.com/scan/cce6fd40-fd72-435e-b900-24868021a23e
  SHA-256: 6817a39ed2800dedba40278a6282bd527662c801b924112800396dc51730a22e
- URLQuery: https://screenshots.phishdestroy.io/uq/575bbd66-3b10-4342-8285-9884b12eefba.png
  Source report: https://urlquery.net/report/575bbd66-3b10-4342-8285-9884b12eefba
  SHA-256: 1cae085cf93c8f2c0a9bcbdc4fb84f92692e12202dacadd0a4559d56fa248bca
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a169b9-02da-72ee-a87f-a8a52df6c6f8.png
  Captured: 2026-10-23 17:05:01 UTC
  Source report: https://urlscan.io/result/01a169b9-02da-72ee-a87f-a8a52df6c6f8/
  SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a169ba-ab6f-764e-8760-332381985049.png
  Captured: 2026-10-23 17:08:43 UTC
  Source report: https://urlscan.io/result/01a169ba-ab6f-764e-8760-332381985049/
  SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T18:04:09Z",
        "uuid": "01a169d0-5ef4-764a-9f51-4accdc3102ff",
        "scanned_at": "2026-10-23T17:30:33Z",
        "final_url": "https://btc024.33113.cc/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://btc024.33113.cc/",
                "from": "http://btc024.33113.cc/",
                "status": 307
            }
        ],
        "ip": "172.67.223.221",
        "domains": [
            "connect.facebook.net",
            "fonts.googleapis.com"
        ],
        "ips": [
            "57.144.244.128",
            "142.250.154.95",
            "172.67.223.221"
        ],
        "asns": [
            "32934",
            "15169",
            "13335"
        ],
        "countries": [
            "DE",
            "US"
        ],
        "doc_hash": "a88b9901160e429e087d882ff5b6c05d913340e96d6eabde0ef4d007e5151bfc",
        "script_hashes": [
            "15bfbedd8bdcfa13f58fc28eb0de28a1db63ec3da5713854a611a8acab22e337",
            "a588fa15b404f8993c38a41da8f282d3555d748116b4ee1d71ad88c4a6434158",
            "9875818bee5b75d745823b8576eafe5bff396d04ccd85eb939011825b4fa2591",
            "3e014383658163b72cbfd4b549236961204f33c5bb39831425f85d332c4d5e46"
        ],
        "globals": [
            "fbq",
            "_fbq",
            "_0xobf3_0x22e5",
            "_0xobf3_0x2344",
            "_0xobf3_0x56f5a2",
            "webpackChunkmini_h5",
            "tailwind",
            "log",
            "/template.html"
        ],
        "cookies": [
            "JSESSIONID"
        ],
        "tls": {
            "san": [
                "33113.cc",
                "*.33113.cc"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "33113.cc",
            "protocol": "QUIC",
            "valid_to": "2027-01-08T13:04:11Z",
            "valid_from": "2026-10-10T12:05:27Z"
        },
        "domain_age_days": 235,
        "apex_age_days": 308,
        "tls_age_days": 13,
        "tls_valid_days": 90,
        "requests": 15,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 71,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T18:04:45Z",
        "uuid": "cce6fd40-fd72-435e-b900-24868021a23e",
        "scanned_at": "2026-10-23T18:04:23Z",
        "final_url": "https://btc024.33113.cc/404.html",
        "status": 200,
        "history": [
            {
                "url": "https://btc024.33113.cc/",
                "status": 200
            },
            {
                "url": "https://btc024.33113.cc/404.html",
                "status": 200
            }
        ],
        "dom_hash": "3f624bdb472d23a0546b5a9f33d41624987cd0f93b01bbf47d2a51c7aaa38f6b",
        "doc_hash": "6da5f5f0c9395f4573dc755298d3a53abf7e7631ae0ee9efe7dd2893e070ed3e",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "btc024.33113.cc",
                "type": "A",
                "value": "172.67.223.221"
            },
            {
                "name": "btc024.33113.cc",
                "type": "A",
                "value": "104.21.46.49"
            },
            {
                "name": "btc024.33113.cc",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:2e31"
            },
            {
                "name": "btc024.33113.cc",
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:dfdd"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.223.221",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2014-04-23T11:42:33Z",
            "updated": "2025-12-19T09:17:04Z",
            "expires": "2027-04-23T11:42:33Z",
            "nameservers": [
                "meadow.ns.cloudflare.com",
                "sergi.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T18:04:07Z",
        "analysis_at": "2026-10-23T09:40:20Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 14,
            "suspicious": 1,
            "undetected": 32
        },
        "detections": {
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "Criminal IP": "phishing",
            "Chong Lua Dao": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Dynadot Inc",
        "created": "2014-04-23T11:42:33Z",
        "expires": "2027-04-23T11:42:33Z",
        "updated": "2025-12-19T09:17:04Z",
        "first_seen": "2026-03-02T13:10:15Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.223.221"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:dfdd"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:2e31"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.46.49"
            }
        ],
        "dns_at": "2026-10-23T09:58:49Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "33113.cc",
                "*.33113.cc"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "e34b8cedc219b8400e23eb81c5e483b3",
            "sha256": "ba563e1ce46e2a625dfa471b7aeb9af2092f29f860accc3075f12468cfdf738f",
            "subject": "33113.cc",
            "valid_to": "2027-01-08T13:04:11Z",
            "valid_from": "2026-10-10T12:05:27Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "http://www.dynadot.com",
            "created": "2014-04-23T11:42:33Z",
            "updated": "2025-12-19T09:17:04Z",
            "expires": "2027-04-23T11:42:33Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "meadow.ns.cloudflare.com",
                "sergi.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T18:05:04Z",
        "caa_records": {
            "domain": "btc024.33113.cc"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-23T17:32:59Z",
            "first": "2026-02-01T17:15:28Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0,
            "avg_page_bytes": 1766
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "trackers": {
            "requests": 8,
            "trackers": [
                {
                    "name": "Facebook",
                    "company": "Meta",
                    "country": "US",
                    "category": "Advertising",
                    "requests": 1
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Facebook Connect",
                    "company": "Meta",
                    "country": "US",
                    "category": "Site Analytics",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 478,
                "tls": 35,
                "wait": 230,
                "connect": 6,
                "download": 0
            },
            "response_ms": 749
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 2432,
            "co2_grams": 0.0001,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.38.51",
                    "host": "meadow.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.35.68",
                    "host": "sergi.ns.cloudflare.com"
                }
            ],
            "zone": "33113.cc"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "JSESSIONID",
                    "secure": true,
                    "session": true,
                    "http_only": true
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3037::6815:2e31",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "33113.cc"
        },
        "dns": {
            "A": [
                "104.21.46.49",
                "172.67.223.221"
            ],
            "AAAA": [
                "2606:4700:3037::ac43:dfdd",
                "2606:4700:3037::6815:2e31"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3037::ac43:dfdd",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://btc024.33113.cc"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2014-04-23T11:42:33Z",
            "updated": "2025-12-19T09:17:04Z",
            "expires": "2027-04-23T11:42:33Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "meadow.ns.cloudflare.com",
                "sergi.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```