# PhishDestroy threat dossier — formula-x.app ================================================================ Fetched: 2026-07-22 02:40:35 UTC Canonical: https://phishdestroy.io/domain/formula-x.app/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Credential Phishing ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/91 security vendors flagged this domain Flagging vendors: Gridinsoft, SOCRadar Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 3.174.46.44 (DE, Frankfurt am Main) ASN: AS16509 Amazon.com, Inc. Hosting org: AS16509 Amazon.com, Inc. Registrar: Amazon Registrar, Inc. Nameservers: ns-1317.awsdns-36.org, ns-1618.awsdns-10.co.uk, ns-250.awsdns-31.com, ns-606.awsdns-11.net Registered: 2026-07-04 Expires: 2027-07-04 Page title: Formula X HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Amazon / Amazon RSA 2048 M01 Expires: 2027-01-17 Status: INVALID chain Fingerprint: 9b54d5f6447a94a5b8c91fc8bbc6dc7930784875950fae4b2f3008584cdd37b1 Subject Alternative Names (related infrastructure — often same operator): - www.formula-x.app ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-04 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-05 15:34:52 UTC (by PhishDestroy tracker) Last verified: 2026-07-22 04:20:23 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f327b-fc0e-7799-ad91-c89fa897e359/ Wayback Machine: https://web.archive.org/web/*/formula-x.app crt.sh CT logs: https://crt.sh/?q=%25.formula-x.app Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=formula-x.app AlienVault OTX: https://otx.alienvault.com/indicator/domain/formula-x.app URLhaus: https://urlhaus.abuse.ch/host/formula-x.app/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-05 15:46:08 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Is formula-x.app a Credential Theft Scam Targeting Users? This domain, formula-x.app, is currently under investigation for credential theft operations targeting unsuspecting users. Analysis indicates the site may impersonate legitimate services or platforms to harvest login credentials, payment details, or other sensitive information. The infrastructure is designed to appear trustworthy, potentially tricking users into entering personal data under false pretenses, such as fake login portals, account verification prompts, or fraudulent support pages. Infrastructure analysis reveals several technical indicators that warrant scrutiny. The domain was registered on July 04, 2026, through Amazon Registrar, Inc., and resolves to the IP address 3.174.46.44. It is hosted on Amazon Web Services, utilizing Amazon S3 for storage and Amazon CloudFront as a content delivery network, alongside HTTP/3 for optimized performance. Despite these legitimate-looking hosting patterns, the domain has not been flagged by any of the 95 security vendors on VirusTotal as of this assessment. Additionally, no blocklist entries have been recorded, which may delay detection by traditional security mechanisms. Users who have visited formula-x.app or interacted with its content should take immediate action to mitigate potential risks. If credentials or personal information were entered on the site, affected accounts should be secured by changing passwords and enabling multi-factor authentication where available. Monitor financial statements and credit reports for unauthorized activity, as stolen credentials may be used for further fraud. It is also recommended to clear browser caches and run a full system scan using updated security tools to detect any residual threats. Given the domain's active status and lack of prior detections, caution is advised when encountering any communications or links associated with formula-x.app. [Updates since narrative was generated:] - Public blocklists: now listed on 3 feeds ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: d9c0dcc9459b009fed3d10e4214b526c TLS cert SHA-256: 9b54d5f6447a94a5b8c91fc8bbc6dc7930784875950fae4b2f3008584cdd37b1 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/formula-x.app/ JSON API: https://api.destroy.tools/v1/check?domain=formula-x.app Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 187,720 domains (57,297 alive under monitoring, 128,779 confirmed takedowns/dead). Site: https://phishdestroy.io