# PhishDestroy threat dossier — d8nnui1j-gift.newyorklivingsolutions.com ================================================================ Fetched: 2026-07-22 06:35:42 UTC Canonical: https://phishdestroy.io/domain/d8nnui1j-gift.newyorklivingsolutions.com/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 47/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/91 security vendors flagged this domain Flagging vendors: Fortinet, SOCRadar URLQuery: 2 detections Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 138.226.237.81 (BZ, Belize City) ASN: AS205775 NEON CORE NETWORK LLC Hosting org: Neon Core Network LLC Registrar: Unstoppable Domains Inc. Nameservers: cameron.ns.cloudflare.com, josephine.ns.cloudflare.com Registered: 2025-09-19 Expires: 2026-09-19 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2025-09-19 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-10 22:34:37 UTC (by PhishDestroy tracker) First reported: 2026-07-12 18:04:26 UTC (abuse notice filed) Last verified: 2026-07-22 08:20:25 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f4dbc-68b0-732c-b528-7e3a110decf4/ URLQuery: https://urlquery.net/report/a72d0ca2-c26b-4fd0-989c-b1c981752965 Wayback Machine: https://web.archive.org/web/*/d8nnui1j-gift.newyorklivingsolutions.com crt.sh CT logs: https://crt.sh/?q=%25.d8nnui1j-gift.newyorklivingsolutions.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=d8nnui1j-gift.newyorklivingsolutions.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/d8nnui1j-gift.newyorklivingsolutions.com URLhaus: https://urlhaus.abuse.ch/host/d8nnui1j-gift.newyorklivingsolutions.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-10 23:05:14 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] d8nnui1j-gift.newyorklivingsolutions.com Safety Check — This domain, d8nnui1j-gift.newyorklivingsolutions.com, is actively engaged in credential theft operations, designed to harvest login credentials, session tokens, or personal identification details from unsuspecting users. Analysis indicates the infrastructure is tailored to mimic legitimate login portals or authentication prompts, often leveraging social engineering tactics such as fake reward offers, account verification requests, or urgent security alerts. The domain’s subdomain structure, including the segment 'gift,' suggests an attempt to lure victims with deceptive incentives, a common tactic in credential harvesting campaigns. Once credentials are entered, they are typically exfiltrated to attacker-controlled servers for immediate exploitation or resale on underground markets. Evidence supporting this assessment includes technical indicators and registration details. The domain is flagged by 1 out of 95 security vendors on VirusTotal, indicating limited but confirmed detection. It was registered on September 19, 2025, through Unstoppable Domains Inc., a registrar often associated with decentralized or blockchain-based domains, which can complicate takedown efforts. The domain currently resolves to the IP address 138.226.237.81, a host that may be part of a broader malicious infrastructure. While only one vendor has flagged the domain at this time, the lack of widespread detection does not diminish the threat, as newly registered phishing domains often evade initial scans until further telemetry is gathered. Users who have interacted with this domain should take immediate action to mitigate potential compromise. If credentials were entered, affected accounts should be secured by changing passwords and enabling multi-factor authentication where available. Session tokens or cookies associated with the compromised accounts should be invalidated by logging out of all active sessions. Additionally, users should monitor linked accounts for unauthorized activity and consider reporting the incident to relevant security teams or incident response platforms. Organizations should update blocklists to include this domain and its associated IP address, while endpoint detection systems should be configured to alert on any connections to d8nnui1j-gift.newyorklivingsolutions.com or 138.226.237.81. Proactive measures, such as user education on recognizing phishing attempts and implementing network-level filtering, can reduce the risk of further exposure. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260712-4E0671 Favicon MD5: 4ae7188c230452e48a87a9c5767d5c35 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/d8nnui1j-gift.newyorklivingsolutions.com/ JSON API: https://api.destroy.tools/v1/check?domain=d8nnui1j-gift.newyorklivingsolutions.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 187,751 domains (57,328 alive under monitoring, 128,779 confirmed takedowns/dead). Site: https://phishdestroy.io