# PhishDestroy threat dossier — enrichsupplies.com ================================================================ Fetched: 2026-04-30 07:33:01 UTC Canonical: https://phishdestroy.io/domain/enrichsupplies.com/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 1/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 14/94 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, DNS8, Fortinet, G-Data, Lionic, Seclookup, SOCRadar, Sophos, VIPRE, Webroot Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 199.79.63.251 (US, Burlington) ASN: AS46606 Unified Layer Hosting org: PDR Registrar: Tucows Domains Inc. Nameservers: ["ns1.bh-20.webhostbox.net", "ns2.bh-20.webhostbox.net"] Registered: 2026-04-13 HTTP response: 406 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-13 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-13 15:11:21 UTC (by PhishDestroy tracker) Last verified: 2026-04-21 16:11:48 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d86be-c9af-72a1-8472-0b35739346f5/ Wayback Machine: https://web.archive.org/web/*/enrichsupplies.com crt.sh CT logs: https://crt.sh/?q=%25.enrichsupplies.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=enrichsupplies.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/enrichsupplies.com URLhaus: https://urlhaus.abuse.ch/host/enrichsupplies.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-13 15:12:53 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies enrichsupplies.com as a high-risk generic phishing domain actively impersonating brands to harvest credentials or deploy cryptocurrency drainers. This domain was flagged by 14/95 security vendors on VirusTotal, indicating widespread suspicion of malicious intent. While the specific brand impersonated is not disclosed in available intelligence, the operational pattern aligns with credential theft campaigns targeting unsuspecting users. The domain's behavior suggests it may redirect victims to fraudulent login pages or inject malicious scripts to siphon cryptocurrency from connected wallets. Given its active status and undisclosed payload, users should treat all interactions with this domain as potentially hazardous. Technical analysis of enrichsupplies.com reveals several red flags consistent with phishing infrastructure. The domain was registered on June 14, 2021, through TUCOWS.COM, CO., a registrar known for accommodating high-risk domains. It resolves to IP address 199.79.63.251 and utilizes a Let's Encrypt SSL certificate to appear legitimate. The domain is flagged as unsafe by Google Safe Browsing (GSB) and appears on 3 security blocklists, including PhishingArmy and PhishingDB. These indicators suggest a mature and well-documented threat source, with a VirusTotal detection ratio of 14/95 security vendors confirming its malicious reputation. Such a low trust score, combined with the domain's age and registrar choice, further corroborates its use in active phishing campaigns. As of the latest assessment, enrichsupplies.com remains active and unmitigated, posing a persistent threat to users who encounter it. Immediate action should be taken by security teams and individuals to block this domain at the network and endpoint levels. Users are advised to avoid accessing enrichsupplies.com entirely and to report any encounters to their security provider or through threat intelligence platforms. Given the domain's high-risk classification and confirmed malicious activity, the residual risk remains severe. No legitimate use case has been identified for this domain, and its continued operation indicates an ongoing campaign with potentially evolving tactics. Proactive monitoring and swift containment are critical to preventing further victimization. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 45b364d4df507edd3889aeb0b3312dde ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/enrichsupplies.com/ JSON API: https://api.destroy.tools/v1/check?domain=enrichsupplies.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io