# PhishDestroy threat dossier — daz3d.live ================================================================ Fetched: 2026-07-23 18:47:45 UTC Canonical: https://phishdestroy.io/domain/daz3d.live/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED !!! REGISTRAR INTEGRITY ALERT — NiceNIC !!! NiceNIC International: over 90% of its registered domains are associated with illegal content; documented systematic abuse-report non-response. Primary sources: https://phishdestroy.io/nicenic-real https://phishdestroy.io/nicenic-verdict Nameservers: earl.ns.cloudflare.com, laura.ns.cloudflare.com Registered: 2026-07-22 Expires: 2027-07-22 Page title: Daz 3D - 3D Models and 3D Software | Daz 3D ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-10-20 Status: INVALID chain Fingerprint: 14fec9198f582edc8016d1ac656966488304b5d8f6baefa2a20fe78b26e1a10a ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-22 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-23 15:47:42 UTC (by PhishDestroy tracker) First reported: 2026-07-23 14:23:59 UTC (abuse notice filed) Last verified: 2026-07-23 20:20:21 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f8f39-f195-7398-bc89-5b708737b10c/ URLQuery: https://urlquery.net/report/b723b91a-2e6b-4ad1-b0e0-fd7c8742c847 Wayback Machine: https://web.archive.org/web/*/daz3d.live crt.sh CT logs: https://crt.sh/?q=%25.daz3d.live Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=daz3d.live AlienVault OTX: https://otx.alienvault.com/indicator/domain/daz3d.live URLhaus: https://urlhaus.abuse.ch/host/daz3d.live/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-23 15:48:36 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] daz3d.live: Confirmed Phishing Site On July 23, 2026, the domain daz3d.live was observed as an active generic phishing infrastructure. The domain was registered on July 22, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is delegated to Cloudflare nameservers earl.ns.cloudflare.com and laura.ns.cloudflare.com. DNS resolution points to the IPv4 address 188.114.96.3, which is the sole hosting endpoint identified for the campaign. The domain appears on a single public blocklist and is explicitly listed as blocked by the PhishDestroy service, indicating that at least one anti‑phishing feed has taken remediation action. VirusTotal analysis shows that one out of ninety‑one scanned security vendors flagged the domain, reinforcing the suspicion raised by the blocklist entry. No additional reputation services, Safe Browsing checks, or Open Threat Exchange (OTX) references are currently available for this indicator. The limited detection surface suggests that the phishing operation is newly deployed and may be targeting a narrow audience before wider dissemination. Defenders should add daz3d.live to local deny lists, monitor DNS queries for the associated Cloudflare nameservers, and consider sink‑holing the IP address 188.114.96.3 to capture any subsequent payload delivery attempts. Continuous re‑evaluation is recommended, as further detection from additional scanners or blocklists would increase confidence in the malicious classification. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260723-EF1A68 Favicon MD5: 78a42ecbc405bd216d1902176355e583 TLS cert SHA-256: 14fec9198f582edc8016d1ac656966488304b5d8f6baefa2a20fe78b26e1a10a ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/daz3d.live/ JSON API: https://api.destroy.tools/v1/check?domain=daz3d.live Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 188,943 domains (58,592 alive under monitoring, 128,729 confirmed takedowns/dead). Site: https://phishdestroy.io