# PhishDestroy domain threat record: f8f8bet.ws

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/f8f8bet.ws/
Machine-readable companion: https://phishdestroy.io/domain/f8f8bet.ws/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-09 18:13:08 UTC
- Last availability or vendor check: 2026-10-22 10:28:20 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: google

## Stored infrastructure

- Observed IP address: 172.67.222.185
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-07-15 20:46:52 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a121d0-156c-7459-a5a4-4a92c294a9a6/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/f8f8bet.ws
- Certificate Transparency search: https://crt.sh/?q=%25.f8f8bet.ws
- Web Archive lookup: https://web.archive.org/web/*/https://f8f8bet.ws/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
f8f8bet.ws is an impersonation phishing page that dresses itself up as F8f8bet, an online bookmaker. Its title, "F8f8bet – Nhà Cái Uy Tín Hàng Đầu Việt Nam 2026", translates to "F8f8bet – Vietnam's Leading Trusted Bookmaker 2026", so its audience is Vietnamese-speaking bettors. PhishDestroy first saw the domain on 2026-10-09. When last checked on 2026-10-19, the site was still online and serving its content.

How the scam works
Betting-brand impersonation depends on players trusting a familiar name. The page claims to be the most reputable bookmaker in Vietnam, then invites visitors to register, log in or fund an account. Anything entered there goes to the operators, including usernames, passwords, phone numbers and banking or e-wallet details. Deposits sent to the payment instructions shown on the page are lost. Balances shown on screen are typically fake, and withdrawals are blocked or made conditional on further payments.

Evidence
On 2026-10-17, six of 92 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and VIPRE. That is a modest count, but it comes from several unrelated vendors, which supports our classification. The domain also appears in two AlienVault OTX threat-intelligence pulses. PhishDestroy is currently the only blocklist on record listing it, so many browsers and filters may not warn users yet.

Infrastructure
The site sits behind Cloudflare, resolving to 172.67.222.185 in Canada. This means the real origin server is hidden from public view. Its certificate comes from Google Trust Services (WE1), so visitors see a normal padlock. That padlock only means the connection is encrypted. It says nothing about whether the operator is legitimate. The .ws extension is unusual for a brand claiming to be Vietnam's top bookmaker, and it is worth a second look.

What to do
If you registered or logged in on f8f8bet.ws, change that password everywhere you reused it. Turn on two-factor authentication for your email and banking apps. If you deposited money or shared card or e-wallet details, contact your bank or payment provider right away to dispute the transaction and freeze the card. Do not pay any "fee", "tax" or "verification deposit" to unlock a withdrawal, because that is the next stage of the theft. Security teams should block the domain at DNS and proxy level and report it to Cloudflare's abuse channel. They should also watch for similar F8f8bet lookalike domains reaching Vietnamese-speaking users.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a121d0-156c-7459-a5a4-4a92c294a9a6/
VirusTotal report: https://www.virustotal.com/gui/domain/f8f8bet.ws
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=f8f8bet.ws
Archived copy: https://web.archive.org/web/20261009181427/https://f8f8bet.ws/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:28:04 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a121d0-156c-7459-a5a4-4a92c294a9a6.png
  Captured: 2026-10-09 18:13:08 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a121d0-156c-7459-a5a4-4a92c294a9a6.png
  Captured: 2026-10-10 03:30:07 UTC
  Source report: https://urlscan.io/result/01a121d0-156c-7459-a5a4-4a92c294a9a6/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/77f5b72f-dcd9-4d35-b243-8b55caa44cc3.png
  Captured: 2026-10-09 18:14:55 UTC
  Source report: https://radar.cloudflare.com/scan/77f5b72f-dcd9-4d35-b243-8b55caa44cc3
  SHA-256: f442ef68a16a029cdf7dd48b41d40c10bd0810f0ba4af6b8a765a4b87acbe934
- URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a121b0-1e1a-76dd-b946-546b5e6a1663.png
  Captured: 2026-10-09 17:22:43 UTC
  Source report: https://urlscan.io/result/01a121b0-1e1a-76dd-b946-546b5e6a1663/
  SHA-256: b61f7ab7d2b2c2a100d4b295bc0eb577a545aaeb063c21b308826e2d8f392465
- URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a121e5-6c2e-720c-9dd9-c47909c71a9c.png
  Captured: 2026-10-09 18:20:55 UTC
  Source report: https://urlscan.io/result/01a121e5-6c2e-720c-9dd9-c47909c71a9c/
  SHA-256: bf04b57cc25352b786267432d48243878d0a79642677b835ef7d9572973c9338

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:35:55Z",
        "uuid": "01a121d0-156c-7459-a5a4-4a92c294a9a6",
        "scanned_at": "2026-10-09T17:57:35Z",
        "final_url": "https://f8f8bet.ws/",
        "status": 200,
        "ip": "172.67.222.185",
        "domains": [
            "fonts.gstatic.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.14.94",
            "142.251.13.95",
            "104.17.207.5",
            "172.67.222.185"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "www.fv88club.vip"
        ],
        "doc_hash": "e388799ab9d1b2612ec7296261b14e7f76e49411356e4131fd026378a3e2bb33",
        "script_hashes": [
            "2470af972e6a552a518a9e151c0a893a0eb3ae9b6f5995d39517685a0d692bdd"
        ],
        "globals": [
            "__brStickSimple",
            "uidEvent",
            "bootstrap",
            "animateCounter",
            "counters",
            "observer"
        ],
        "tls": {
            "san": [
                "f8f8bet.ws",
                "*.f8f8bet.ws"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "f8f8bet.ws",
            "protocol": "QUIC",
            "valid_to": "2026-12-14T22:27:44Z",
            "valid_from": "2026-09-15T21:27:54Z"
        },
        "domain_age_days": 82,
        "apex_age_days": 82,
        "tls_age_days": 23,
        "tls_valid_days": 90,
        "requests": 34,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:46:29Z",
        "uuid": "77f5b72f-dcd9-4d35-b243-8b55caa44cc3",
        "scanned_at": "2026-10-09T18:14:55Z",
        "final_url": "https://f8f8bet.ws/",
        "status": 200,
        "history": [
            {
                "url": "https://f8f8bet.ws/",
                "status": 200
            }
        ],
        "dom_hash": "31052b02be179e6712f72c96b02ab45354ffd72150737922cebd1d6f2f5aef6c",
        "doc_hash": "e388799ab9d1b2612ec7296261b14e7f76e49411356e4131fd026378a3e2bb33",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "f8f8bet.ws",
                "type": "A",
                "value": "104.21.94.109"
            },
            {
                "name": "f8f8bet.ws",
                "type": "A",
                "value": "172.67.222.185"
            },
            {
                "name": "f8f8bet.ws",
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:deb9"
            },
            {
                "name": "f8f8bet.ws",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:5e6d"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.94.109"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T04:04:38Z",
        "analysis_at": "2026-10-17T22:00:37Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 5,
            "suspicious": 1,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Gambling, Phishing (alphaMountain.ai)"
        },
        "registrar": "Dynadot",
        "created": "2026-07-15T22:46:52Z",
        "updated": "2026-07-18T20:19:10Z",
        "first_seen": "2026-07-18T20:10:10Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:5e6d"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "jarred.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:deb9"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "jarred.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "nancy.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.94.109"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.222.185"
            }
        ],
        "dns_at": "2026-10-17T22:01:03Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "f8f8bet.ws",
                "*.f8f8bet.ws"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "9cf6053e404dfae50e2c8880c9aec5ca",
            "sha256": "be64da2a3ab92fd1794cc151ada98fa43792d72267ada74a0f12cd3ff7845b6d",
            "subject": "f8f8bet.ws",
            "valid_to": "2026-12-14T22:27:44Z",
            "valid_from": "2026-09-15T21:27:54Z"
        },
        "whois": {
            "registrar": "Dynadot",
            "registrar_iana_id": "1637",
            "registrar_url": "http://www.dynadot.com",
            "created": "2026-07-15T22:46:52Z",
            "updated": "2026-07-18T20:19:10Z",
            "expires": "2027-07-15T22:46:52Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "jarred.ns.cloudflare.com",
                "nancy.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```