# PhishDestroy domain threat record: duplicate-disabled-420660.invalid

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/duplicate-disabled-420660.invalid/
Machine-readable companion: https://phishdestroy.io/domain/duplicate-disabled-420660.invalid/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-08-09 22:40:09 UTC
- Last availability or vendor check: 2026-10-27 02:25:48 UTC
- Stored record updated: 2026-10-27 23:22:16 UTC
- VirusTotal detections in the stored snapshot: 15/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 78.135.82.192
- Registration date in stored WHOIS data: 2026-06-10 22:00:00 UTC

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/duplicate-disabled-420660.invalid
- Certificate Transparency search: https://crt.sh/?q=%25.duplicate-disabled-420660.invalid
- Web Archive lookup: https://web.archive.org/web/*/https://duplicate-disabled-420660.invalid/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
duplicate-disabled-420660.invalid is a domain on the PhishDestroy blocklist. It has not yet been assigned a specific scheme type, and no impersonated brand has been identified. PhishDestroy first saw it on 2026-08-10. The site has been offline since 2026-09-25 and was still unreachable at the last check on 2026-10-19.

How the scam works
The served page carried only the title "403 Forbidden", so its content gives no sign of what it was meant to imitate. That title is a server access-denied message, while the domain sits on our blocklist as suspicious. Fifteen security vendors independently flagged the domain, which suggests it was associated with harmful activity rather than being an ordinary broken site. On domains like this, the main risk is a page that asks for wallet connections, seed phrases or login credentials. No specific scheme has been confirmed for this one.

Evidence
On 2026-09-14, VirusTotal showed detections from 15 of 89 engines. That is a meaningful minority for a site with no visible content. The flagging vendors include Kaspersky, BitDefender, Fortinet, Forcepoint ThreatSeeker, G-Data, Gridinsoft, alphaMountain.ai and the Vietnamese anti-scam project Chong Lua Dao. Detection by that many unrelated vendors, combined with PhishDestroy's own listing, is why the domain is treated as unsafe.

Infrastructure
The domain resolved to 78.135.82.192 on the HostLAB Bilisim Teknolojileri A.S. network in Turkey. It used a free, automatically issued Let's Encrypt certificate, so the padlock in the browser said nothing about whether the site was trustworthy. The domain stayed online for roughly six weeks after PhishDestroy first saw it, then went dark on 2026-09-25.

What to do
If you visited this domain and entered a password, change it and turn on two-factor authentication for that account. If you connected a crypto wallet or approved a transaction there, review and revoke any token approvals you do not recognize. If you typed in a seed phrase, move your funds to a new wallet immediately. Defenders should block the domain and its IP at DNS and proxy level. They should also search logs for past connections and report any related domains that appear on the same hosting.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/duplicate-disabled-420660.invalid
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=duplicate-disabled-420660.invalid
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:54:31 UTC

## Stored page captures

- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3d31534b-533c-4f6e-81af-a93895ff3992.png
  Captured: 2026-08-11 01:06:22 UTC
  Source report: https://radar.cloudflare.com/scan/3d31534b-533c-4f6e-81af-a93895ff3992
  SHA-256: 28fa085914a8eac5b91d635b1475d50ebd3886d62a2cad2787a06d991cd27055

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T10:25:29Z",
        "uuid": "3d31534b-533c-4f6e-81af-a93895ff3992",
        "scanned_at": "2026-08-11T01:06:22Z",
        "final_url": "https://www.tetherusdtistanbul.com.websitedukkani.com.tr/",
        "status": 403,
        "history": [
            {
                "url": "https://www.tetherusdtistanbul.com.websitedukkani.com.tr/",
                "status": 403
            }
        ],
        "dom_hash": "0a226e7ff0226df9c1b312239c3a21c005ded97c86cc005e8bbdb5decc778a66",
        "doc_hash": "7271dd5c11fb9a1052a5e91a09afbe7d148fd3388dc51c338df62a0a16f06739",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "www.tetherusdtistanbul.com.websitedukkani.com.tr",
                "type": "A",
                "value": "78.135.82.192"
            }
        ],
        "dnssec_valid": false,
        "ip": "78.135.82.192",
        "whois": {
            "created": "2026-06-11T00:00:00Z",
            "expires": "2027-06-10T00:00:00Z"
        }
    }
}
```