# PhishDestroy threat dossier — dfpmarket.live ================================================================ Fetched: 2026-07-29 14:03:02 UTC Canonical: https://phishdestroy.io/domain/dfpmarket.live/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 5/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 88.222.222.231 (LT, Vilnius) ASN: AS47583 Hostinger International Limited Hosting org: Hostinger International Ltd. Registrar: GoDaddy.com, LLC Nameservers: aurora.dns-parking.com, nebula.dns-parking.com Registered: 2025-11-04 Expires: 2026-11-04 Page title: DFP Market | Access a Wealth of Trading Opportunities HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-09-03 Status: INVALID chain Fingerprint: 809795286811fe7f6dc63934808da05e4eeb6e1beca7a90bccd6890cfffeeb26 Subject Alternative Names (related infrastructure — often same operator): - www.dfpmarket.live ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2025-11-04 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-27 06:03:46 UTC (by PhishDestroy tracker) First reported: 2026-07-27 05:22:08 UTC (abuse notice filed) Last verified: 2026-07-29 12:40:47 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019fa2a1-46aa-70ef-a257-19f16371f652/ URLQuery: https://urlquery.net/report/78025f0a-6e79-4630-8a0f-46b1aaa6fba8 Wayback Machine: https://web.archive.org/web/*/dfpmarket.live crt.sh CT logs: https://crt.sh/?q=%25.dfpmarket.live Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=dfpmarket.live AlienVault OTX: https://otx.alienvault.com/indicator/domain/dfpmarket.live URLhaus: https://urlhaus.abuse.ch/host/dfpmarket.live/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-27 06:04:57 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] dfpmarket.live Potential Phishing Site Analysis of dfpmarket.live indicates active malicious infrastructure as of July 27, 2026. The domain was registered through GoDaddy.com, LLC on November 04, 2025 and resolves to the IP address 88.222.222.76. DNS records are hosted on aurora.dns-parking.com and nebula.dns-parking.com, both typical of parking services rather than legitimate business infrastructure. Security telemetry shows that one of ninety‑one antivirus or URL reputation engines on VirusTotal has flagged the domain, suggesting at least one independent detection of suspicious behavior. The domain is currently listed on the PhishDestroy blocklist and appears on an additional security blocklist, confirming that external threat‑intelligence feeds have identified it as hostile. No public information about SSL certificates, HTTP response codes, page titles, or landing‑page content is available, leaving the visual and functional characteristics of the site unverified. Defenders should treat dfpmarket.live as high‑risk, block network traffic to the associated IP address, and add the domain to local deny lists. Continuous monitoring of the IP and DNS records is advised, as the hosting provider could shift services without notice. Organizations using URL filtering should ensure the domain is included in their deny lists, and any email security gateways should be configured to flag messages containing links to dfpmarket.live. Because the exact phishing payload or targeted brand is not yet disclosed, response teams should remain vigilant for any user reports of unexpected login prompts or credential requests that reference this domain. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260727-E33995 Favicon MD5: fd61e79e196adca1ea96f58f1024aaab TLS cert SHA-256: 809795286811fe7f6dc63934808da05e4eeb6e1beca7a90bccd6890cfffeeb26 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/dfpmarket.live/ JSON API: https://api.destroy.tools/v1/check?domain=dfpmarket.live Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,478 domains (83,245 alive under monitoring, 109,716 confirmed takedowns/dead). Site: https://phishdestroy.io