# PhishDestroy threat dossier — cxvdsg.christmas ================================================================ Fetched: 2026-07-15 08:19:30 UTC Canonical: https://phishdestroy.io/domain/cxvdsg.christmas/ ## VERDICT ---------------------------------------------------------------- ACTIVE THREAT — multiple warning signs Composite threat score: 56/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 10/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, CRDF, ESET, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Sophos URLQuery: 2 detections Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 47.242.217.10 (HK, Hong Kong) ASN: AS45102 Alibaba (US) Technology Co., Ltd. Hosting org: Hong Kong Registrar: Spaceship, Inc. Nameservers: launch1.spaceship.net, launch2.spaceship.net Registered: 2026-07-09 Expires: 2027-07-09 Page title: 首页 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: none Status: INVALID chain ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-09 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-15 07:45:47 UTC (by PhishDestroy tracker) First reported: 2026-07-15 05:47:53 UTC (abuse notice filed) Last verified: 2026-07-15 10:17:29 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f644e-770a-72ff-97d8-95401386342b/ URLQuery: https://urlquery.net/report/fa829234-ab7e-457b-b10c-7d2d21e3dcd0 Wayback Machine: https://web.archive.org/web/*/cxvdsg.christmas crt.sh CT logs: https://crt.sh/?q=%25.cxvdsg.christmas Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=cxvdsg.christmas AlienVault OTX: https://otx.alienvault.com/indicator/domain/cxvdsg.christmas URLhaus: https://urlhaus.abuse.ch/host/cxvdsg.christmas/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-15 08:00:21 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] The domain cxvdsg.christmas was registered on July 09, 2026 through Spaceship, Inc. and is currently hosted on the IP address 47.242.217.10, using the authoritative nameservers launch1.spaceship.net and launch2.spaceship.net. VirusTotal scans show that 10 of 91 security vendors have flagged the domain, indicating a consensus of malicious behavior. The domain is classified as a generic_phishing threat and is marked as active with a high risk rating. Infrastructure analysis confirms that the domain’s recent creation and immediate detection suggest a rapid deployment typical of credential harvesting campaigns. While the specific payload or target brand has not been disclosed, the presence of multiple vendor detections and the domain’s association with a known registrar warrant immediate defensive actions. Security teams should consider adding the domain and its resolving IP to blocklists, monitoring DNS queries for related lookups, and employing sinkholing where feasible. Continuous re‑evaluation is advised as additional intelligence becomes available. [Updates since narrative was generated:] - VirusTotal detections: now 10/91 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260715-2A4BCD ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/cxvdsg.christmas/ JSON API: https://api.destroy.tools/v1/check?domain=cxvdsg.christmas Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 179,138 domains (50,742 alive under monitoring, 128,396 confirmed takedowns/dead). Site: https://phishdestroy.io