# PhishDestroy domain threat record: duplicate-disabled-1049627.invalid

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/duplicate-disabled-1049627.invalid/
Machine-readable companion: https://phishdestroy.io/domain/duplicate-disabled-1049627.invalid/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-05 04:40:09 UTC
- Last availability or vendor check: 2026-10-21 01:16:23 UTC
- Stored record updated: 2026-10-22 14:22:00 UTC
- VirusTotal detections in the stored snapshot: 3/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Google

## Stored infrastructure

- Observed IP address: 104.21.7.150
- Registrar in stored WHOIS data: NameMart Pte. Ltd.
- Registration date in stored WHOIS data: 2026-07-28 00:23:00 UTC

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/duplicate-disabled-1049627.invalid
- Certificate Transparency search: https://crt.sh/?q=%25.duplicate-disabled-1049627.invalid
- Web Archive lookup: https://web.archive.org/web/*/https://duplicate-disabled-1049627.invalid/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy classifies duplicate-disabled-1049627.invalid as an impersonation phishing page, a site built to pass itself off as a legitimate service so visitors trust it with sensitive information. We first flagged it on 2026-09-05. It went offline on 2026-09-25 and was still unreachable on 2026-10-19. Its page title read "Just a moment...", the wording of a generic browser-check screen rather than branded content, while our classification is impersonation phishing.

How the scam works
Impersonation phishing copies the look, name or tone of a service people already use, such as an exchange, wallet or support desk. The aim is to make a login form, recovery prompt or wallet connection request feel routine. Anything entered there goes to the operator, not the real service. Depending on what the copy asks for, victims can lose account passwords and one-time codes, seed phrases, or funds sent to addresses the scammer controls.

Evidence
On 2026-09-19, three of 89 VirusTotal engines flagged the domain: alphaMountain.ai, Forcepoint ThreatSeeker and SOCRadar. That is a low count, and most engines had not caught up with the site before it went dark. Three AlienVault OTX threat pulses also reference it, which means other researchers tracked it independently. The domain is on the PhishDestroy blocklist.

Infrastructure
The domain was registered through NameMart Pte. Ltd. on 2026-07-28, 39 days before we detected it. That gap suggests the operators let it sit before putting it to use. Traffic resolved to Cloudflare, Inc. addresses geolocated in Canada. Because Cloudflare acts as a reverse proxy, the server that actually hosted the content stays hidden behind it. The site stayed up for about three weeks after our first sighting.

What to do
If you typed a password on this site, change it on the genuine service and on any other account that uses the same password. Then turn on app-based or hardware two-factor authentication. If you entered a seed phrase or private key, treat that wallet as compromised and move your assets to a new wallet created on a clean device. If you connected a wallet or signed anything, review and revoke token approvals you do not recognize. Defenders should block the domain, search proxy and DNS logs for visits between 2026-09-05 and 2026-09-25, and reset credentials for any users who reached it.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/duplicate-disabled-1049627.invalid
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=duplicate-disabled-1049627.invalid
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 11:01:29 UTC

## Stored page captures

- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f9799c73-13d2-43ca-aa02-49c757ffc6fa.png
  Captured: 2026-09-15 04:02:03 UTC
  Source report: https://radar.cloudflare.com/scan/f9799c73-13d2-43ca-aa02-49c757ffc6fa
  SHA-256: fc694c93f2bf75fe72d9a0c7adb511da602346193c9cf9c99ae34dfd9c7000ef

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:25:16Z",
        "uuid": "f9799c73-13d2-43ca-aa02-49c757ffc6fa",
        "scanned_at": "2026-09-15T04:02:03Z",
        "final_url": "https://www.hrtsae.top/main.html",
        "status": 200,
        "redirected": "https-only",
        "history": [
            {
                "url": "http://www.hrtsae.top/",
                "status": 307
            },
            {
                "url": "https://www.hrtsae.top/",
                "status": 200
            },
            {
                "url": "https://www.hrtsae.top/main.html",
                "status": 200
            },
            {
                "url": "https://www.hrtsae.top/main.html",
                "status": 200
            }
        ],
        "dom_hash": "13838e60a2a9edc78fab6e09945b95ecc6c320869b8d654f40a38cea83649b7b",
        "doc_hash": "afc2da54b61978a2e9af471b153d201cf138150fce759b591c550c2b811c9664",
        "phishing_v2": [
            "phishing"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "www.hrtsae.top",
                "type": "A",
                "value": "172.67.136.113"
            },
            {
                "name": "www.hrtsae.top",
                "type": "A",
                "value": "104.21.7.150"
            },
            {
                "name": "www.hrtsae.top",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:796"
            },
            {
                "name": "www.hrtsae.top",
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:8871"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.136.113",
        "whois": {
            "registrar": "NameMart Pte. Ltd.",
            "created": "2026-07-28T02:23:00Z",
            "updated": "2026-07-28T02:29:00Z",
            "expires": "2027-07-28T02:23:00Z",
            "nameservers": [
                "gabriel.ns.cloudflare.com.",
                "gloria.ns.cloudflare.com."
            ]
        }
    }
}
```