# PhishDestroy threat dossier — freedev.app ================================================================ Fetched: 2026-07-29 23:14:10 UTC Canonical: https://phishdestroy.io/domain/freedev.app/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 10/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, Chong Lua Dao, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Gridinsoft, Lionic, VIPRE AlienVault OTX: 4 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 31.22.4.234 (GB, Newcastle upon Tyne) ASN: AS34119 Wildcard UK Limited Hosting org: I Fastnet Ltd Registrar: Spaceship, Inc. Nameservers: ["ns1.byet.org", "ns2.byet.org", "ns3.byet.org", "ns4.byet.org", "ns5.byet.org"] Page title: freedev.app is hosted by InfinityFree HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R12 Expires: 2026-08-25 Status: INVALID chain Fingerprint: 1beb4b5dc620a45d830e3e5bc6587c6b35f3e282e717db2827fec2fa7c401e7d Subject Alternative Names (related infrastructure — often same operator): - www.freedev.app ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-26 05:13:08 UTC (by PhishDestroy tracker) Last verified: 2026-07-30 00:29:03 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-26 05:14:55 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Is freedev.app a Phishing Site? Analysis of freedev.app indicates that it is currently classified as a high‑risk generic phishing infrastructure. The domain resolves to a set of Byet.org nameservers (ns1.byet.org through ns5.byet.org), a hosting arrangement commonly leveraged by malicious operators to obtain rapid provisioning and anonymity. Registration data shows the domain was purchased through Spaceship, Inc., a registrar that does not apply strict abuse‑mitigation controls, which further lowers the barrier for malicious use. VirusTotal has recorded detections from ten of ninety‑one scanned security vendors, confirming that multiple independent engines have identified malicious characteristics associated with the host. HTTP probing returns a 200 OK status, indicating that the web server is actively serving content and is reachable by clients. The domain appears on one public blocklist and is specifically blocked by the PhishDestroy service, reinforcing the consensus that it is being used for phishing attempts. The site remains listed as active as of the report date, July 26, 2026, and no indication of takedown or remediation has been observed. Defenders should treat any traffic to freedev.app as hostile. Network sensors should block outbound connections to the domain and its associated IP ranges, and DNS filtering should be configured to return NXDOMAIN or a safe response for queries to the domain. Endpoint protection platforms should be updated to include the observed VirusTotal signatures to improve detection rates. Because the underlying hosting provider may allocate additional IP addresses to the same nameserver pool, security teams should monitor for new resolutions of the Byet.org nameservers that could point to fresh malicious sites. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: a99428be0b18e253420b027aa47d23cf TLS cert SHA-256: 1beb4b5dc620a45d830e3e5bc6587c6b35f3e282e717db2827fec2fa7c401e7d ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/freedev.app/ JSON API: https://api.destroy.tools/v1/check?domain=freedev.app Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,510 domains (93,335 alive under monitoring, 99,913 confirmed takedowns/dead). Site: https://phishdestroy.io