# PhishDestroy domain threat record: crd-market.su Content language: English Canonical HTML report: https://phishdestroy.io/domain/crd-market.su/ Machine-readable companion: https://phishdestroy.io/domain/crd-market.su/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-25 07:06:15 UTC - Last availability or vendor check: 2026-10-22 10:12:10 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 4/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: telegram ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: RUCENTER-SU - Last stored HTTP status: 301 - Registration date in stored WHOIS data: 2026-04-23 02:52:06 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a037bc-ccd3-7326-bf04-c44cd3dabbb1/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/crd-market.su - Certificate Transparency search: https://crt.sh/?q=%25.crd-market.su - Web Archive lookup: https://web.archive.org/web/*/https://crd-market.su/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview crd-market.su presents itself as the sign-in page of CRD-Market, a site whose own title calls it a "Pro Carding Community & MarketPlace." Anyone who believes they are logging in to that forum and marketplace is the target. PhishDestroy first flagged the domain on 2026-08-25. As of 2026-10-19 it was still online and answering with a redirect, so it should be treated as active. How the scam works The page carries the title "Log in | CRD-Market - Pro Carding Community & MarketPlace" and mimics that service's entry point. A visitor who arrives through a search result, a forum link or a mistyped address enters a username and password, and the operator receives them. Accounts on marketplaces of this kind often hold deposited balances, frequently in cryptocurrency, along with private messages and order history. Once the login is stolen, all of that can be taken over. The redirect it currently serves may pass visitors on after their details are captured, which makes the theft harder to notice. Evidence Detection is thin so far. On 2026-10-06, 4 of 91 VirusTotal engines flagged the domain: alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. It appears in 4 AlienVault OTX pulses, which shows other researchers have tied it to malicious activity. Among blocklists, only PhishDestroy currently lists it, so most browsers and security filters will probably not warn visitors. Infrastructure The domain was registered on 2026-04-23 through RUCENTER-SU under the .su zone. That is roughly four months before PhishDestroy detected it, which suggests it was set up in advance and given time to build up traffic. It resolves to 188.114.97.3 on Cloudflare's network, geolocated to Canada. Cloudflare's proxy hides the server that actually hosts the page. What to do If you entered a username or password on this page, change that password immediately on the genuine service and on every other site where you used it. Enable two-factor authentication where it is offered, and review recent logins, sessions and any stored balance for activity you did not perform. Do not log in through this domain again, and reach the service only from an address you have verified yourself. Defenders should block crd-market.su at DNS and proxy level and search their logs for past visits. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a037bc-ccd3-7326-bf04-c44cd3dabbb1/ VirusTotal report: https://www.virustotal.com/gui/domain/crd-market.su Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=crd-market.su Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:56:30 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Hf5q6jJT/9031a21b5ab0.png Captured: 2026-08-25 07:06:15 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a037bc-ccd3-7326-bf04-c44cd3dabbb1.png Captured: 2026-08-25 07:06:15 UTC Source report: https://urlscan.io/result/01a037bc-ccd3-7326-bf04-c44cd3dabbb1/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:32:50Z", "uuid": "01a037bc-ccd3-7326-bf04-c44cd3dabbb1", "scanned_at": "2026-08-25T07:05:21Z", "final_url": "https://crd-market.su/", "status": 403, "redirected": "https-only", "redirects": [ { "to": "https://crd-market.su/", "from": "http://crd-market.su/", "status": 307 } ], "ip": "188.114.97.3", "domains": [ "i.imgur.com", "crd-market.io" ], "ips": [ "172.67.179.224", "199.232.192.193", "188.114.97.3" ], "asns": [ "13335", "54113" ], "countries": [ "US" ], "link_domains": [ "3wsan5znvpmyghkozirwtne2nhzj6usfn426dhh6mndqja7funqzqsyd.onion", "hulkcc.vip", "bearvault.cc", "yale-club.vip", "teknokesif.com.tr", "xenforo.com", "www.addonflare.com", "teslacloud.net", "xfwiz.com", "xentr.net", "www.stylesfactory.pl", "t.me" ], "social": [ "https://t.me/crdmk1", "https://t.me/Crdmk1" ], "doc_hash": "78de802b38f4340ead66deaf39f57864ef86cff2e570f9510792f5a9457f4e01", "script_hashes": [ "f8f0d5e29e4408e8ecdccee5e73a185566774f71c7f440cc50ad5c647b127ce3", "f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d", "3507ca14c84cbffccd872e634a84d93f50882c817e66ffdf2643a7ed884a205e", "f80c38460fd41d1adf2d7f4699ad6836f73cb5e21c021322596d05c2bddcd1aa", "87c1485b49078a8cf6e2fe375ca6f1db87dd92619672fb6742a094d389ceaf5b", "8bff857e62d45e635318ebfee1c29cb65b6e66a2e147c79deb91aad29e29ff6d", "bfe3ecad86362036bfbf2e0d2bc27a6a593cb0fff32a97a5b1b5f81b409a3bb6", "d29ce7d0bcd5b07f9f11fa479a6636e586d8af743b9f8dfa6ba5698e8b0bd8d5", "b0e6169e39f5c8f93c0dae464faa49979fd869e935a0f9b8be0cb53f04349f57" ], "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart", "XF", "$", "jQuery", "Mustache", "autosize", "thnoticesplus", "usernameColorTagList" ], "cookies": [ "xf_csrf" ], "storage_keys": [ "xf___crossTab", "xf_visitorCounts", "xf_cacheKey" ], "tls": { "san": [ "*.crd-market.su", "crd-market.su" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "crd-market.su", "protocol": "QUIC", "valid_to": "2026-11-17T18:12:20Z", "valid_from": "2026-08-19T18:12:21Z" }, "domain_age_days": 123, "apex_age_days": 123, "tls_age_days": 5, "tls_valid_days": 89, "requests": 25, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31536000; includeSubDomains; preload", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T06:00:10Z", "uuid": "5d222511-24f7-4a8e-aa17-042ae9135bc7", "scanned_at": "2026-08-25T07:11:49Z", "final_url": "https://crd-market.su/", "status": 403, "redirected": "https-only", "history": [ { "url": "http://crd-market.su/", "status": 307 }, { "url": "https://crd-market.su/", "status": 403 } ], "dom_hash": "0eeb00822e3a746ee7ed974024b28239583cfdbfa1680cbc913f8871d635b44d", "doc_hash": "de22cc50a3c05af1dc2b49a41f4f38443cc3714635470c87e49af1132e2d5daa", "domain_risks": [ "Login Screens", "Miscellaneous" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "crd-market.su", "type": "A", "value": "188.114.97.3" }, { "name": "crd-market.su", "type": "A", "value": "188.114.96.3" }, { "name": "crd-market.su", "type": "AAAA", "value": "2a06:98c1:3121::3" }, { "name": "crd-market.su", "type": "AAAA", "value": "2a06:98c1:3120::3" } ], "dnssec_valid": false, "ip": "188.114.97.3", "whois": { "registrar": "RUCENTER-SU", "created": "2026-04-23T04:52:06Z", "expires": "2027-04-23T04:52:06Z", "nameservers": [ "camilo.ns.cloudflare.com", "kia.ns.cloudflare.com" ] } } } ```