# PhishDestroy domain threat record: duplicate-disabled-5359.invalid

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/duplicate-disabled-5359.invalid/
Machine-readable companion: https://phishdestroy.io/domain/duplicate-disabled-5359.invalid/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2025-09-11 23:36:04 UTC
- Last availability or vendor check: 2026-10-21 01:10:36 UTC
- Stored record updated: 2026-10-22 06:21:23 UTC
- VirusTotal detections in the stored snapshot: 1/95
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Apple

## Stored infrastructure

- Observed IP address: 66.29.141.228
- Registrar in stored WHOIS data: NETIM
- Registrar country in stored WHOIS data: FR
- Registration date in stored WHOIS data: 2025-07-10 04:31:36 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01993b90-4bab-723c-885b-fa7defbc5744/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/duplicate-disabled-5359.invalid
- Certificate Transparency search: https://crt.sh/?q=%25.duplicate-disabled-5359.invalid
- Web Archive lookup: https://web.archive.org/web/*/https://duplicate-disabled-5359.invalid/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Analysis as of July 22 2026 indicates that the domain www.toshfts.com was registered on 10 July 2025 through NETIM. The authoritative nameservers are simon.ns.cloudflare.com and tori.ns.cloudflare.com, pointing to a hosting address of 66.29.141.228, which belongs to AS22612 (Namecheap, Inc.) and is geolocated in the United States. TLS termination uses a Sectigo Limited / Sectigo Public Server Authentication CA DV R36 certificate, confirming the presence of HTTPS. The web server reports PHP running behind LiteSpeed, and the page title returned by the HTTP response is “Cryptocurrency trading and invest platform”, suggesting a financial‑themed lure.

The domain is classified as a tech‑support scam that impersonates Apple, aligning with the known brand target. Security telemetry shows that PhishDestroy has blocked the site and it appears on a single external blocklist. VirusTotal analysis recorded a single positive detection out of 95 scanners, and Gridinsoft assigned a trust score of 0 / 100, indicating a high likelihood of malicious intent. MX records list mx1-hosting.jellyfish.systems with priority 5 and an additional host with priority 10, though the second entry is truncated.

The domain’s current HTTP status is offline, confirming that the malicious infrastructure has been taken down. While the available data confirms the use of a crypto‑investment narrative and a tech‑support scam vector, the exact content of the phishing pages, credential‑capture mechanisms, or any associated command‑and‑control infrastructure remain unknown. Defenders should continue to block the IP address 66.29.141.228, add the domain and its MX hosts to email and web filtering policies, and monitor for future re‑use of the hosting provider or certificate. Ongoing observation of related Namecheap assets and of any newly registered domains that resolve to the same IP range is recommended to pre‑empt potential re‑deployment of the campaign.
Analysis generated: 2026-07-22 16:03:31 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01993b90-4bab-723c-885b-fa7defbc5744.png
  Captured: 2026-03-05 01:33:23 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01993b90-4bab-723c-885b-fa7defbc5744.png
  Captured: 2026-03-05 01:33:23 UTC
  Source report: https://urlscan.io/result/01993b90-4bab-723c-885b-fa7defbc5744/