# PhishDestroy domain threat record: com-gateway-api-gateway-dex-app.cloud Content language: English Canonical HTML report: https://phishdestroy.io/domain/com-gateway-api-gateway-dex-app.cloud/ Machine-readable companion: https://phishdestroy.io/domain/com-gateway-api-gateway-dex-app.cloud/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-16 14:24:04 UTC - Last availability or vendor check: 2026-10-22 10:00:25 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 9/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: MetaMask ## Stored infrastructure - Observed IP address: 103.224.182.189 - Registrar in stored WHOIS data: Web Commerce Communications Ltd. - Registrar country in stored WHOIS data: MY - Last stored HTTP status: 200 - Registration date (registry RDAP, com-gateway-api-gateway-dex-app.cloud): 2025-10-14 18:41:48 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a14518-75db-702d-8a2f-96ebe378c895/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/com-gateway-api-gateway-dex-app.cloud - Certificate Transparency search: https://crt.sh/?q=%25.com-gateway-api-gateway-dex-app.cloud - Web Archive lookup: https://web.archive.org/web/*/https://com-gateway-api-gateway-dex-app.cloud/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview com-gateway-api-gateway-dex-app.cloud is an impersonation phishing page. Its hostname is built from words like gateway, api, dex and app so that it reads like an official decentralized exchange endpoint. It targets crypto users who reach it through search results, ads or shared links. PhishDestroy first saw the domain on 2026-10-16, and the site was still alive with live content on 2026-10-19. How the scam works Impersonation pages of this type copy the look and wording of a legitimate trading or wallet service so visitors believe they are on the real thing. The page title only repeats the domain name and does not identify a specific brand. The usual goal is to get the visitor to connect a wallet, sign a transaction or approval, or type in a seed phrase or private key. Any of these hands control of the victim's funds to the operators, and the tokens can then be moved out within minutes. Evidence VirusTotal detection is low. 2 of 92 engines flag the domain as of 2026-10-16, and the flagging vendors are alphaMountain.ai and Webroot. The classification is backed more strongly by crypto-specific blocklists. The domain is listed by PhishDestroy, MetaMask and SEAL, and it appears in 4 AlienVault OTX threat pulses. Many security products may still not warn about it. Infrastructure The domain was registered on 2025-10-14 through Web Commerce Communications Ltd. It resolves to 103.224.182.189 on the Trellian Pty. Limited network, located in the US. The site serves HTTPS with a certificate issued by Let's Encrypt (YE1), which only means the connection is encrypted and says nothing about whether the site is legitimate. What to do If you only visited the page, close it and do not return. Reach decentralized exchanges only through bookmarks or the project's verified channels. If you connected a wallet or signed anything, use a token approval checker to revoke every permission granted to unfamiliar contracts, and move your remaining assets to a fresh wallet. If you entered a seed phrase or private key, treat that wallet as fully compromised and transfer whatever is left to a new wallet created on a clean device. Defenders should block the domain and its IP at DNS and proxy level and add it to wallet and browser protection lists. They should also report it to the registrar and hosting provider so the page can be taken down. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a14518-75db-702d-8a2f-96ebe378c895/ VirusTotal report: https://www.virustotal.com/gui/domain/com-gateway-api-gateway-dex-app.cloud Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=com-gateway-api-gateway-dex-app.cloud Archived copy: https://web.archive.org/web/20261016142741/https://com-gateway-api-gateway-dex-app.cloud/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:21:55 UTC ## Stored page captures - Primary capture: https://i.ibb.co/j93cNmNF/20ed58c24094.png Captured: 2026-10-16 14:24:04 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a14518-75db-702d-8a2f-96ebe378c895.png Captured: 2026-10-16 14:24:04 UTC Source report: https://urlscan.io/result/01a14518-75db-702d-8a2f-96ebe378c895/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d4d019df-6c0b-4ce4-91e6-57619a5c7a4a.png Captured: 2026-10-16 14:55:32 UTC Source report: https://radar.cloudflare.com/scan/d4d019df-6c0b-4ce4-91e6-57619a5c7a4a SHA-256: 53970874455ab30559aa5764d4076bf88ab76090a5f5d5a4e021437e11552f8f - URLQuery: https://screenshots.phishdestroy.io/uq/baf579f6-5309-4cbd-aa43-4059798e6403.png Source report: https://urlquery.net/report/baf579f6-5309-4cbd-aa43-4059798e6403 SHA-256: a7360f1f4bae45826a6b56eb3849aa64d266a141842e3aa14433e296db350f87 - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a144d4-e5b5-7218-9927-7af16a931ce9.png Captured: 2026-10-16 13:09:31 UTC Source report: https://urlscan.io/result/01a144d4-e5b5-7218-9927-7af16a931ce9/ SHA-256: 9862423bc9cbe33d10144bd3cf6ad4f6c632ed3f2c8cc787654a08f207b96522 - URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14869-ee6d-762c-8653-beeffcb78f25.png Captured: 2026-10-17 05:51:18 UTC Source report: https://urlscan.io/result/01a14869-ee6d-762c-8653-beeffcb78f25/ SHA-256: 020462faf071e24748fafc3419d224ba594cee760eed7428485c7b7938f1f651 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T17:45:38Z", "uuid": "01a14518-75db-702d-8a2f-96ebe378c895", "scanned_at": "2026-10-16T14:23:22Z", "final_url": "https://com-gateway-api-gateway-dex-app.cloud/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://com-gateway-api-gateway-dex-app.cloud/", "from": "http://com-gateway-api-gateway-dex-app.cloud/", "status": 307 } ], "ip": "103.224.182.189", "ptr": "lb-182-189.above.com", "domains": [ "assets.abovedomains.com" ], "ips": [ "152.233.50.2", "103.224.182.189" ], "asns": [ "212238", "133618" ], "countries": [ "US" ], "link_domains": [ "webnic.cc" ], "doc_hash": "244e8350f4a6fb1a3aec8b0fef9f98bf303848aee46d2d342c215058ab00008b", "tls": { "san": [ "*.20533.net", "*.2599dl10.top", "*.3y77cc.com", "*.5461738d48c3e5881863dbbc0e2becbb.com", "*.601259.com", "*.9kk13.com", "*.archpresbytery.world", "*.aurevion.info", "*.bittalentconnect.com", "*.c1x2.cc" ], "cipher": "AES_256_GCM", "issuer": "YE1", "subject": "20533.net", "protocol": "TLS 1.3", "valid_to": "2027-01-12T20:12:24Z", "valid_from": "2026-10-14T20:12:25Z" }, "domain_age_days": 366, "apex_age_days": 366, "tls_age_days": 1, "tls_valid_days": 89, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 54, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T17:58:52Z", "uuid": "d4d019df-6c0b-4ce4-91e6-57619a5c7a4a", "scanned_at": "2026-10-16T14:55:32Z", "final_url": "https://com-gateway-api-gateway-dex-app.cloud/", "status": 200, "history": [ { "url": "https://com-gateway-api-gateway-dex-app.cloud/", "status": 200 } ], "dom_hash": "f737d713dbf8c2aa26cc80eb4c4bbd657f709164e12199b75b72a4d0c4d8e763", "doc_hash": "fa9f050935c19b1178cbfc1016cc43cec673552475cfe635bc1504c2462093db", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "com-gateway-api-gateway-dex-app.cloud", "type": "A", "value": "103.224.182.189" } ], "dnssec_valid": false, "ip": "103.224.182.189", "whois": { "registrar": "Web Commerce Communications Ltd.", "created": "2025-10-14T18:41:48Z", "updated": "2026-10-14T18:42:26Z", "expires": "2027-10-14T18:41:48Z", "nameservers": [ "ns100.webnic.cc", "ns101.webnic.cc" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-20T19:44:50Z", "analysis_at": "2026-10-20T02:00:13Z", "stats": { "timeout": 0, "harmless": 50, "malicious": 8, "suspicious": 1, "undetected": 33 }, "detections": { "CRDF": "malicious", "G-Data": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "suspicious", "Kaspersky": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "categories": { "Webroot": "Phishing and Other Frauds", "alphaMountain.ai": "Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds" }, "created": "2025-10-14T00:00:00Z", "first_seen": "2025-10-14T19:18:15Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "synth-ip-c0a86410.com-gateway-api-gateway-dex-app.cloud" }, { "ttl": 21600, "type": "A", "value": "103.224.182.189" }, { "ttl": 21600, "type": "SOA", "rname": "hostmaster.com-gateway-api-gateway-dex-app.cloud", "value": "com-gateway-api-gateway-dex-app.cloud" } ], "dns_at": "2026-10-20T02:00:36Z", "jarm": "28d28d28d00028d00042d42d00000051af7d8070a18e002eaaedf620fa118c", "cert": { "san": [ "*.20533.net", "*.2599dl10.top", "*.3y77cc.com", "*.5461738d48c3e5881863dbbc0e2becbb.com", "*.601259.com", "*.9kk13.com", "*.archpresbytery.world", "*.aurevion.info", "*.bittalentconnect.com", "*.c1x2.cc" ], "issuer": "Let's Encrypt / YE1", "serial": "6aae526c5faaf96edeb714cc5349f568dce", "sha256": "bf6a7ba88be5b98d6846cb930fa30a4afef8eaee71ce1193ace8f5b410fab865", "subject": "20533.net", "valid_to": "2027-01-12T20:12:24Z", "valid_from": "2026-10-14T20:12:25Z" }, "rdap": { "status": [ "client hold" ], "events": { "expiration": "2026-10-14T18:41:48Z", "last changed": "2025-10-19T18:42:46Z", "registration": "2025-10-14T18:41:48Z", "last update of RDAP database": "2026-03-17T22:15:05Z" }, "registrar": "Web Commerce Communications Ltd.", "registrar_iana_id": "460" } } } ```