# PhishDestroy domain threat record: falawor.cyou

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/falawor.cyou/
Machine-readable companion: https://phishdestroy.io/domain/falawor.cyou/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 02:02:15 UTC
- Last availability or vendor check: 2026-10-26 02:09:29 UTC
- Stored record updated: 2026-10-26 03:35:37 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 85.121.4.201
- Registrar in stored WHOIS data: NAMECHEAP INC
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-02-03 11:13:22 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a175f6-e27d-7116-95a6-819d2f3c2bc1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/falawor.cyou
- Certificate Transparency search: https://crt.sh/?q=%25.falawor.cyou
- Web Archive lookup: https://web.archive.org/web/*/https://falawor.cyou/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed falawor.cyou on 2026-10-26 after an automated detection flagged the domain as malicious on VirusTotal. The recorded page title was “falawor.cyou” and the HTTP response was 200 when fetched on 2026-10-26. No phishing, impersonation, or wallet‑draining behavior was directly observed on the page.

How the scam works
The current evidence does not demonstrate a specific scam technique; the domain is flagged as suspicious based on external detections that often relate to phishing or malware distribution. Without observed credential forms, malicious scripts, or wallet requests, the listing reflects a risk category rather than a confirmed attack vector.

Evidence
VirusTotal reported one malicious detection out of 92 engines on 2026-10-23, with SOCRadar labeling the domain as phishing. Google Safe Browsing showed no flag on 2026-10-26. Two urlscan captures were recorded: the 2026-08-08 scan returned a malicious verdict, while the 2026-10-26 scan gave an overall non‑malicious verdict but its engine scoring marked it malicious with a score of 83. OTX listed three pulses mentioning the domain as of 2026-10-26. PhishDestroy’s internal blocklist includes the domain, while external blocklists reported zero hits on the check date.

Infrastructure
The domain was registered on 2026-02-03 through NameCheap Inc. The domain resolved to IP 85.121.4.201, which was associated with Alexhost SRL in Moldova at the time of observation. TLS was provided by Let’s Encrypt, valid from 2026-10-22 to 2027-01-20, and the domain used Cloudflare name servers aliza.ns.cloudflare.com and earl.ns.cloudflare.com. The site responded with an Nginx server header and served HTML content.

What to do
Visitors should treat the site as untrusted; avoid entering any credentials or personal data and change passwords if any were submitted. Organizations should add falawor.cyou to web filtering policies, monitor outbound connections to 85.121.4.201, and review logs for any access attempts. No further remediation is required unless user data was actually compromised.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a175f6-e27d-7116-95a6-819d2f3c2bc1/
Cloudflare Radar report: https://radar.cloudflare.com/scan/1c7afad6-a764-4e90-a22d-32a32fcfac28
Stored capture screenshot: https://i.ibb.co/whj6JChx/30c3e2515fe3.png
Cloudflare Radar screenshot (2026-10-26T02:04:16Z): https://screenshots.phishdestroy.io/cf/1c7afad6-a764-4e90-a22d-32a32fcfac28.png
VirusTotal report: https://www.virustotal.com/gui/domain/falawor.cyou
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=falawor.cyou
Archived copy: https://web.archive.org/web/20261026020251/https://falawor.cyou/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 02:38:06 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/whj6JChx/30c3e2515fe3.png
  Captured: 2026-10-26 02:09:29 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a175f6-e27d-7116-95a6-819d2f3c2bc1.png
  Captured: 2026-10-26 02:09:29 UTC
  Source report: https://urlscan.io/result/01a175f6-e27d-7116-95a6-819d2f3c2bc1/
- URLScan capture 2: https://screenshots.phishdestroy.io/019fe0d1-3e14-7217-b9ed-c152a790ba8d.png
  Captured: 2026-10-26 02:02:15 UTC
  Source report: https://urlscan.io/result/01a175f6-e27d-7116-95a6-819d2f3c2bc1/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1c7afad6-a764-4e90-a22d-32a32fcfac28.png
  Captured: 2026-10-26 02:04:16 UTC
  Source report: https://radar.cloudflare.com/scan/1c7afad6-a764-4e90-a22d-32a32fcfac28
  SHA-256: 1299facdb12c4662a38fd86d54ae6e17d6d1de5fab77aa7c8130507713253514
- URLQuery: https://screenshots.phishdestroy.io/uq/444c49a6-b567-4247-a68a-f03727c5843a.png
  Source report: https://urlquery.net/report/444c49a6-b567-4247-a68a-f03727c5843a
  SHA-256: c440ef1a16c0662a48bcc7fe4d23ac873331e0b31d8f9c403be1f7e2ad65dc60
- URLScan · 2026-08-08: https://screenshots.phishdestroy.io/us/019fe0d1-3e14-7217-b9ed-c152a790ba8d.png
  Captured: 2026-08-08 10:01:11 UTC
  Source report: https://urlscan.io/result/019fe0d1-3e14-7217-b9ed-c152a790ba8d/
  SHA-256: 0dde6ff61c18506396c15afee9f4def597c7fba2c7ee47be855f2194b5fcc6c8
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a175fa-e573-72eb-a597-86257865ffd2.png
  Captured: 2026-10-26 02:12:25 UTC
  Source report: https://urlscan.io/result/01a175fa-e573-72eb-a597-86257865ffd2/
  SHA-256: 7013ca94d4f8386594be924532da4bbb3c07821025ee865c24b73fa969e89ae2

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T02:37:45Z",
        "uuid": "01a175f6-e27d-7116-95a6-819d2f3c2bc1",
        "scanned_at": "2026-10-26T02:08:08Z",
        "final_url": "https://falawor.cyou/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://falawor.cyou/",
                "from": "http://falawor.cyou/",
                "status": 307
            },
            {
                "to": "http://falawor.cyou/",
                "from": "https://falawor.cyou/",
                "status": 307
            },
            {
                "to": "https://falawor.cyou/",
                "from": "http://falawor.cyou/",
                "status": 301
            }
        ],
        "ip": "85.121.4.201",
        "ptr": "vps8",
        "ips": [
            "85.121.4.201"
        ],
        "asns": [
            "200019"
        ],
        "countries": [
            "MD"
        ],
        "doc_hash": "6d52c66571bd840a3e47a3ceca10324a70440c5dd704d1765e844d8983226c31",
        "tls": {
            "san": [
                "falawor.cyou",
                "www.falawor.cyou"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YE2",
            "subject": "falawor.cyou",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-20T05:43:48Z",
            "valid_from": "2026-10-22T05:43:49Z"
        },
        "domain_age_days": 264,
        "apex_age_days": 264,
        "tls_age_days": 3,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 83,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx/1.24.0 (Ubuntu)",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T02:06:01Z",
        "uuid": "1c7afad6-a764-4e90-a22d-32a32fcfac28",
        "scanned_at": "2026-10-26T02:04:16Z",
        "final_url": "https://falawor.cyou/",
        "status": 200,
        "history": [
            {
                "url": "https://falawor.cyou/",
                "status": 200
            }
        ],
        "dom_hash": "4c2b00079e270a285a071a8485cf4f228bdced9eaf324ca4bef805d934af33e1",
        "doc_hash": "6d52c66571bd840a3e47a3ceca10324a70440c5dd704d1765e844d8983226c31",
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "falawor.cyou",
                "type": "A",
                "value": "85.121.4.201"
            }
        ],
        "dnssec_valid": false,
        "ip": "85.121.4.201",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-02-03T12:13:22Z",
            "updated": "2026-03-01T12:17:30Z",
            "expires": "2027-02-03T23:59:59Z",
            "nameservers": [
                "aliza.ns.cloudflare.com",
                "darwin.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T02:34:20Z",
        "analysis_at": "2026-10-23T03:25:19Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 1,
            "suspicious": 0,
            "undetected": 35
        },
        "detections": {
            "SOCRadar": "phishing"
        },
        "reputation": 0,
        "created": "2026-02-03T00:00:00Z",
        "updated": "2026-02-03T00:00:00Z",
        "first_seen": "2026-02-03T12:50:23Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "aliza.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "aliza.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "85.121.4.201"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "mail.falawor.cyou",
                "priority": 1
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "earl.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-23T03:40:08Z",
        "jarm": "28d28d28d00028d00042d42d000000e1ea2a807a629b496b664cf07ad7c08d",
        "cert": {
            "san": [
                "falawor.cyou",
                "www.falawor.cyou"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5913e5b4aa9caf152a49d05e3c08134e44a",
            "sha256": "6bbaa4f43dffac2d2226577c737a6ac75a76b2f5aa165fe5dee0502d9bbadce7",
            "subject": "falawor.cyou",
            "valid_to": "2027-01-20T05:43:48Z",
            "valid_from": "2026-10-22T05:43:49Z"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "server transfer prohibited",
                "add period"
            ],
            "events": {
                "registration": "2026-02-03T12:13:22Z",
                "registrar expiration": "2027-02-03T12:13:22Z",
                "last update of RDAP database": "2026-04-04T05:52:53Z"
            },
            "registrar": "NAMECHEAP INC",
            "registrar_iana_id": "1068"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T02:06:11Z",
        "mail_config": {
            "mx": [
                "mail.falawor.cyou"
            ],
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "falawor.cyou"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-26T02:02:51Z",
            "first": "2026-10-24T20:31:03Z",
            "changes": 0,
            "days_archived": 2,
            "scans_per_day": 0.81,
            "avg_page_bytes": 2706
        },
        "robots_txt": {
            "agents": [
                "*",
                "GPTBot",
                "OAI-SearchBot",
                "ChatGPT-User",
                "ClaudeBot"
            ],
            "present": true,
            "llms_txt": true,
            "sitemaps": [
                "https://falawor.cyou/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 1
        },
        "social_tags": {
            "ogUrl": "https://falawor.cyou/",
            "title": "falawor.cyou",
            "ogType": "website",
            "robots": "index,follow,max-image-preview:large,max-snippet:-1,max-video-preview:-1",
            "ogTitle": "falawor.cyou",
            "ogSiteName": "falawor.cyou",
            "description": "Articles based on video reviews: topic breakdowns, key takeaways and answers to common questions.",
            "twitterCard": "summary",
            "canonicalUrl": "https://falawor.cyou/",
            "ogDescription": "Articles based on video reviews: topic breakdowns, key takeaways and answers to common questions."
        },
        "trackers": {
            "requests": 3
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 14,
                "tls": 63,
                "wait": 38,
                "connect": 39,
                "download": 1
            },
            "response_ms": 155
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 6355,
            "co2_grams": 0.0002,
            "cleaner_than": 82
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.55",
                    "host": "aliza.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.59.161",
                    "host": "earl.ns.cloudflare.com"
                }
            ],
            "zone": "falawor.cyou"
        },
        "location": {
            "ip": "85.121.4.201",
            "asn": "200019",
            "org": "Alexhost SRL",
            "city": "Chisinau",
            "country": "MD"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "falawor.cyou"
        },
        "dns": {
            "A": [
                "85.121.4.201"
            ],
            "MX": [
                "{\"exchange\": \"mail.falawor.cyou\", \"priority\": 1}"
            ],
            "NS": [
                "aliza.ns.cloudflare.com",
                "earl.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"aliza.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418109207, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "85.121.4.201",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://falawor.cyou"
            ]
        },
        "linked_pages": {
            "internal_count": 3
        },
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-02-03T12:13:22Z",
            "updated": "2026-03-01T12:17:30Z",
            "expires": "2027-02-03T23:59:59Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "aliza.ns.cloudflare.com",
                "darwin.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx/1.24.0 (Ubuntu)",
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```