# PhishDestroy domain threat record: dnc1qk.csb.app

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/dnc1qk.csb.app/
Machine-readable companion: https://phishdestroy.io/domain/dnc1qk.csb.app/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 08:25:57 UTC
- Last availability or vendor check: 2026-10-25 11:00:26 UTC
- Stored record updated: 2026-10-25 14:07:13 UTC
- VirusTotal detections in the stored snapshot: 13/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.64.151.115
- Registrar in stored WHOIS data: NAMECHEAP INC
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2018-05-08 14:00:02 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a07967-28e3-776d-8630-369e65db254b/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/dnc1qk.csb.app
- Certificate Transparency search: https://crt.sh/?q=%25.dnc1qk.csb.app
- Web Archive lookup: https://web.archive.org/web/*/https://dnc1qk.csb.app/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed dnc1qk.csb.app on 2026-10-25 after the domain triggered its intake rule for multiple VirusTotal malicious detections. The recorded page title is "Sandbox - CodeSandbox". A page fetch on the same day returned HTTP 400 with a client‑side redirect, while a later webcheck recorded HTTP 200. The domain was first seen by PhishDestroy on 2026-10-25.

How the scam works
The listing is based on generic malicious indicators; many AV engines label the domain as phishing, but no specific phishing page or credential‑stealing form was observed. Domains with such flags are commonly used to host deceptive content, redirect users, or harvest login data, though the current page only shows a sandbox interface without evident malicious functionality.

Evidence
VirusTotal (retrieved 2026-10-25, analysis 2026-10-13) reported 13 detections across 92 engines: 12 malicious and 1 suspicious, with vendors such as BitDefender, Kaspersky, and Fortinet flagging it as phishing. Google Safe Browsing checked 2026-10-25 and reported no threat. urlscan.io captured the site on 2026-09-07; its overall verdict was clean, but its engine score marked it malicious (score 17). OTX listed zero pulses as of 2026-10-25. PhishDestroy’s internal blocklist marks the domain as present; external blocklists reported none. Cloudflare Radar scanned on 2026-10-25 returned HTTP 403.

Infrastructure
The recorded DNS records listed A entries 172.64.151.115 (GB) and 104.18.36.141 (US) and AAAA entries 2606:4700:440d::ac40:9773 and 2a06:98c1:3102::6812:248d, indicating Cloudflare as the CDN provider (ASN 13335). TLS is provided by Google Trust Services, valid until 2026-12-05, covering csb.app and its subdomains. The domain and apex are 1,455 days old. Nameservers are adel.ns.cloudflare.com and greg.ns.cloudflare.com; DNSSEC is not enabled.

What to do
Visitors should avoid entering credentials or personal data on the site; if any credentials were submitted, change them immediately. No wallet‑related actions are required as wallet recommendations are disabled. Defenders should block the exact domain dnc1qk.csb.app, monitor access logs for requests to its IPs, and note that Cloudflare WAF is present but does not guarantee safety.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a07967-28e3-776d-8630-369e65db254b/
Cloudflare Radar report: https://radar.cloudflare.com/scan/1f61cd70-2586-4217-918e-d33aa1d37632
Stored capture screenshot: https://urlscan.io/screenshots/01a07967-28e3-776d-8630-369e65db254b.png
Cloudflare Radar screenshot (2026-10-25T08:35:45Z): https://screenshots.phishdestroy.io/cf/1f61cd70-2586-4217-918e-d33aa1d37632.png
VirusTotal report: https://www.virustotal.com/gui/domain/dnc1qk.csb.app
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=dnc1qk.csb.app
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 08:38:24 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a07967-28e3-776d-8630-369e65db254b.png
  Captured: 2026-10-25 08:25:57 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a07967-28e3-776d-8630-369e65db254b.png
  Source report: https://urlscan.io/result/01a07967-28e3-776d-8630-369e65db254b/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1f61cd70-2586-4217-918e-d33aa1d37632.png
  Captured: 2026-10-25 08:35:45 UTC
  Source report: https://radar.cloudflare.com/scan/1f61cd70-2586-4217-918e-d33aa1d37632
  SHA-256: c4e5ea55e3400887e6b4785fd5a2af00b3c53526c394df3f24abed175bddbb3b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T08:37:53Z",
        "uuid": "01a07967-28e3-776d-8630-369e65db254b",
        "scanned_at": "2026-09-07T01:06:47Z",
        "final_url": "https://dnc1qk.csb.app/lasting.htm",
        "status": 400,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://dnc1qk.csb.app/lasting.htm",
                "from": "http://dnc1qk.csb.app/lasting.htm",
                "status": 307
            }
        ],
        "ip": "104.18.36.141",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "173.194.205.94",
            "173.194.175.95",
            "104.18.36.141"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "2bb1d7690d6a4ad17d07c82f2f1ff9f9264065ba04cc045f37fa21c77f19c80b",
        "globals": [
            "btnAnswerYes"
        ],
        "cookies": [
            "csb_anon_uid"
        ],
        "tls": {
            "san": [
                "csb.app",
                "*.csb.app",
                "preview.csb.app",
                "*.preview.csb.app"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "csb.app",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-05T04:37:02Z",
            "valid_from": "2026-09-06T03:37:22Z"
        },
        "domain_age_days": 1455,
        "apex_age_days": 1455,
        "tls_age_days": 0,
        "tls_valid_days": 90,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 17,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html, charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T08:37:56Z",
        "uuid": "1f61cd70-2586-4217-918e-d33aa1d37632",
        "scanned_at": "2026-10-25T08:35:45Z",
        "final_url": "https://dnc1qk.csb.app/",
        "status": 403,
        "history": [
            {
                "url": "https://dnc1qk.csb.app/",
                "status": 403
            }
        ],
        "dom_hash": "e1e0ec04ba2dccd9143717ccf431a0c9d267fac4083951806a2652b5fb5fcf8d",
        "doc_hash": "cfdfd790bc4bab6c2c8dec638868cc957e6de80cab356ff0a2ddbf4fd5123108",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "dnc1qk.csb.app",
                "type": "A",
                "value": "104.18.36.141"
            },
            {
                "name": "dnc1qk.csb.app",
                "type": "A",
                "value": "172.64.151.115"
            },
            {
                "name": "dnc1qk.csb.app",
                "type": "AAAA",
                "value": "2606:4700:440d::ac40:9773"
            },
            {
                "name": "dnc1qk.csb.app",
                "type": "AAAA",
                "value": "2a06:98c1:3102::6812:248d"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.18.36.141"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T08:34:39Z",
        "analysis_at": "2026-10-13T09:37:32Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 12,
            "suspicious": 1,
            "undetected": 32
        },
        "detections": {
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "NAMECHEAP INC",
        "created": "2018-05-08T16:00:02Z",
        "expires": "2027-05-08T16:00:02Z",
        "updated": "2022-06-15T08:46:31Z",
        "first_seen": "2024-03-04T16:46:39Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:440d::ac40:9773"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.64.151.115"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.18.36.141"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2a06:98c1:3102::6812:248d"
            }
        ],
        "dns_at": "2026-10-13T09:43:26Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "csb.app",
                "*.csb.app",
                "preview.csb.app",
                "*.preview.csb.app"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "542a49540b0677e30e17223369aaca78",
            "sha256": "8e0a09b3b31a58d59b6397f2190e7522606c2e94814c2815fa29a8ac7154f8b1",
            "subject": "csb.app",
            "valid_to": "2026-12-05T04:37:02Z",
            "valid_from": "2026-09-06T03:37:22Z"
        },
        "whois": {
            "registrar": "NAMECHEAP INC",
            "registrar_iana_id": "1068",
            "registrar_url": "http://www.namecheap.com",
            "created": "2018-05-08T16:00:02Z",
            "updated": "2022-04-29T11:13:42Z",
            "expires": "2027-05-08T16:00:02Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "adel.ns.cloudflare.com",
                "greg.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T08:38:08Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "dnc1qk.csb.app"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-25T08:28:13Z",
            "first": "2026-10-25T08:28:13Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 1796
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "social_tags": {
            "title": "Sandbox - CodeSandbox"
        },
        "mixed_content": {
            "no_sri": [
                "https://codesandbox.io/static/browserfs12/browserfs.min.js",
                "https://codesandbox.io/static/js/vendors~embed~sandbox-startup.94f8a764c.chunk.js",
                "https://codesandbox.io/static/js/default~app~embed~sandbox~sandbox-startup.06fa816c4.chunk.js",
                "https://codesandbox.io/static/js/vendors~app~codemirror-editor~monaco-editor~sandbox.f80b3d7b3.chunk.js",
                "https://codesandbox.io/static/js/common-sandbox.9e074986a.chunk.js",
                "https://codesandbox.io/static/js/vendors~embed~sandbox.db748f498.chunk.js",
                "https://codesandbox.io/static/js/vendors~sandbox.84fa4b581.chunk.js",
                "https://codesandbox.io/static/js/default~app~embed~sandbox.5b0f0d656.chunk.js",
                "https://codesandbox.io/static/js/sandbox-startup.862593056.js",
                "https://codesandbox.io/static/js/sandbox.d867b1f77.js"
            ],
            "third_party_scripts": 11
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 13,
                "wait": 174,
                "connect": 6,
                "download": 0
            },
            "response_ms": 195
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "173.245.59.115",
                    "host": "greg.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.32.55",
                    "host": "adel.ns.cloudflare.com"
                }
            ],
            "zone": "csb.app"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "csb_anon_uid",
                    "secure": true,
                    "session": true,
                    "http_only": true
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3102::6812:248d",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "csb.app"
        },
        "dns": {
            "A": [
                "172.64.151.115",
                "104.18.36.141"
            ],
            "AAAA": [
                "2606:4700:440d::ac40:9773",
                "2a06:98c1:3102::6812:248d"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3102::6812:248d",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://dnc1qk.csb.app"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```