# PhishDestroy threat dossier — drgn50.com
================================================================

Fetched:   2026-07-29 06:10:05 UTC
Canonical: https://phishdestroy.io/domain/drgn50.com/

## VERDICT
----------------------------------------------------------------
HIGH THREAT — malicious activity confirmed
Composite threat score: 78/100 (PhishDestroy scoring — see methodology below)

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      0/91 security vendors flagged this domain
Public blocklists: listed on 1 independent blocklist

## INFRASTRUCTURE
----------------------------------------------------------------
IP address:      212.86.126.181 (NL, Haarlem)
Hosting org:     AS43641 SOLLUTIUM EU Sp z.o.o.
Registrar:       Global Domain Group LLC
Nameservers:     eugene.ns.cloudflare.com, faye.ns.cloudflare.com
Registered:      2026-07-11
Expires:         2027-07-11
Page title:      Драгон Мани: играть в онлайн казино | Dragon Money
HTTP response:   200

## TLS CERTIFICATE
----------------------------------------------------------------
Issuer:     Let's Encrypt / YR2
Expires:    2026-10-09
Status:     INVALID chain
Fingerprint: d28e19b209a9579d4ef551b71d94c343145072629b3ea345d7d00e090221029b
Subject Alternative Names (related infrastructure — often same operator):
  - www.drgn50.com

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: pending notification queue. No abuse reports filed yet — this domain is
waiting for the next cycle of our automated abuse-reporter.

## TIMELINE
----------------------------------------------------------------
Domain registered: 2026-07-11 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration)
First detected:    2026-07-28 13:25:04 UTC (by PhishDestroy tracker)
First reported:    2026-07-28 11:29:42 UTC (abuse notice filed)
Last verified:     2026-07-29 04:23:22 UTC
Current status:    ACTIVE / observable

## EXTERNAL CORROBORATION (third-party evidence)
----------------------------------------------------------------
URLScan.io:       https://urlscan.io/result/019fa877-19c9-764c-bfe0-3a2dc5b6d221/
URLQuery:         https://urlquery.net/report/d3d06db7-601e-4313-a028-1a27a06aa9dc
Wayback Machine:  https://web.archive.org/web/*/drgn50.com
crt.sh CT logs:   https://crt.sh/?q=%25.drgn50.com
Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=drgn50.com
AlienVault OTX:   https://otx.alienvault.com/indicator/domain/drgn50.com
URLhaus:          https://urlhaus.abuse.ch/host/drgn50.com/

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-07-28 13:25:19 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

Is drgn50.com a Phishing Site?

The domain drgn50.com was registered on July 11 2026 through Global Domain Group LLC and remains active as of the report date (July 28 2026). Its authoritative name servers are eugene.ns.cloudflare.com and faye.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. DNS resolution points to the IPv4 address 212.86.126.181, which is the sole host observed for this domain.

The infrastructure has been flagged by the PhishDestroy blocklist and appears on one additional security blocklist, suggesting that at least one trusted threat‑intelligence feed considers the domain malicious. VirusTotal has processed the domain with 91 antivirus or URL‑reputation engines, none of which returned a detection; however, the absence of a detection does not constitute evidence of safety. No public SSL certificate details, HTTP response codes, page titles, or brand‑specific references have been disclosed, leaving the content of the site unverified.

The combination of recent creation, Cloudflare‑based hosting, a single IP address, and inclusion on a phishing‑focused blocklist aligns with patterns commonly observed in generic phishing infrastructure. Defenders should treat drgn50.com as high‑risk: block network traffic to the domain and its resolved IP, monitor DNS queries for future resolution changes, and consider adding the domain to internal deny lists. Continuous re‑evaluation is advised, as additional telemetry (e.g., payload analysis, URL redirects, or user reports) may emerge to clarify the threat’s exact scope.

## EVIDENCE HASHES
----------------------------------------------------------------
PhishDestroy Case ID:  PD-20260728-240C77
Favicon MD5:       57930abdee98c3dd83a8345c0d74f76b
TLS cert SHA-256:      d28e19b209a9579d4ef551b71d94c343145072629b3ea345d7d00e090221029b

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (operator takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/drgn50.com/
JSON API:          https://api.destroy.tools/v1/check?domain=drgn50.com
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: independent open-source threat-intelligence platform.
Tracked: 192,970 domains (82,939 alive under monitoring, 107,970 confirmed takedowns/dead). Site: https://phishdestroy.io