# freeusdt.best — Recorded security evidence | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/freeusdt.best/ Machine-readable companion: https://phishdestroy.io/domain/freeusdt.best/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: Unverified - First observed by PhishDestroy: 2026-11-02 07:48:23 UTC - Selected availability observation: 2026-11-02T07:48:23Z - Stored record updated: 2026-11-02 09:27:03 UTC - VirusTotal detections in the stored snapshot: 5/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored infrastructure - Observed IP address: 172.67.155.163 - Registrar in stored WHOIS data: Spaceship, Inc. - Registration date in stored WHOIS data: 2026-06-07 04:03:57 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a19b39-5269-7283-bebf-d5194524d1f3/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/freeusdt.best - Certificate Transparency search: https://crt.sh/?q=%25.freeusdt.best - Web Archive lookup: https://web.archive.org/web/*/https://freeusdt.best/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy stores a record for freeusdt.best. Source observations are dated separately; missing checks do not establish safety. PhishDestroy stores a record for freeusdt.best. Source observations are dated separately; missing checks do not establish safety. A reviewed analysis is not available for this text revision. Consult the dated source records below. Package revision: 896c54030718b601084d02566379c7701a682122c7e68568e2eff3967fae7bcc Source facts (timestamps as stored): {"record_id":1741719,"first_recorded_at":"2026-11-02 08:48:23","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":5,"denominator":92,"malicious":1,"suspicious":4,"vendors":{"Webroot":"malicious","SOCRadar":"suspicious","Gridinsoft":"suspicious","alphaMountain.ai":"suspicious","Forcepoint ThreatSeeker":"suspicious"},"observed_at":"2026-11-02T03:35:06Z","checked_at":null,"fetched_at":"2026-11-02T09:26:11Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":5,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","Forcepoint ThreatSeeker","Gridinsoft","SOCRadar","Webroot"],"observed_at":"2026-11-02 03:35:06","checked_at":"2026-11-02 10:26:15","fetched_at":"2026-11-02 09:26:15","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"Webroot":"malicious","SOCRadar":"suspicious","Gridinsoft":"suspicious","alphaMountain.ai":"suspicious","Forcepoint ThreatSeeker":"suspicious"},"vendor_names":["Webroot","SOCRadar","Gridinsoft","alphaMountain.ai","Forcepoint ThreatSeeker"],"stats":{"timeout":0,"harmless":53,"malicious":1,"suspicious":4,"undetected":34}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-02 10:26:34"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":null},"availability":{"state":"unknown","label_key":"availability.unverified","detail_key":"detail.inconclusive","params":[],"source":"current_state_backfill","record_id":1741719,"scope":"checked_url","observed_at":"2026-11-02T07:48:23Z","http_status":null,"http_observed_at":"2026-11-02T07:48:23Z","stored_http_code":null,"stored_http_observed_at":"2026-11-02T07:48:23Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"unknown","content_classification_at":null,"registration_state":"unknown","policy":"20261102-dated-availability-v1"}} ## Stored page captures - Stored capture: https://i.ibb.co/JNQ4ZgY/9e5155be55b9.png - URLScan · 2026-11-02: https://screenshots.phishdestroy.io/us/01a19b39-5269-7283-bebf-d5194524d1f3.png Captured: 2026-11-02 07:46:35 UTC Source report: https://urlscan.io/result/01a19b39-5269-7283-bebf-d5194524d1f3/ SHA-256: eb7d286f60e7466c916de1729eba439b846f4de28775449441597eda13c74c1a - URLScan · 2026-08-20: https://screenshots.phishdestroy.io/us/01a01f9b-fa6d-71d9-9c3f-73eeca68f548.png Captured: 2026-08-20 14:38:40 UTC Source report: https://urlscan.io/result/01a01f9b-fa6d-71d9-9c3f-73eeca68f548/ SHA-256: e70d8b5147e29fc436b456e75b61577836e5c2d8143aef59b15bf8abde234371 - URLScan · 2026-08-20: https://screenshots.phishdestroy.io/us/01a01f9d-eb84-737f-a6fb-1afeae20c354.png Captured: 2026-08-20 14:40:45 UTC Source report: https://urlscan.io/result/01a01f9d-eb84-737f-a6fb-1afeae20c354/ SHA-256: 860d3e00b35a70bbc0e44e9534f874622bda712272da7572d234b3022abec916 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/75ce77d5-725e-43db-9d8f-ced5f31d2ed6.png Captured: 2026-11-02 08:22:32 UTC Source report: https://radar.cloudflare.com/scan/75ce77d5-725e-43db-9d8f-ced5f31d2ed6 SHA-256: 7073de7ac49f9648e08650d2cc21e912dae1a8b0249a883a755dd7fd433efcfb ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-11-02T07:52:33Z", "uuid": "01a19b39-5269-7283-bebf-d5194524d1f3", "scanned_at": "2026-11-02T07:46:35Z", "final_url": "https://freeusdt.best/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://freeusdt.best/", "from": "http://freeusdt.best/", "status": 307 } ], "ip": "172.67.155.163", "domains": [ "cryptofaucet.cc", "cdn.ccnsad.com", "newassets.hcaptcha.com", "ad2bitcoin.com", "bitcotasks.com", "adbitcoin.cc", "adtether.cc", "cdnjs.cloudflare.com", "href.li", "cryptocoinsad.com", "cryptofisher.online", "zerads.com", "cdn.tailwindcss.com", "api.hcaptcha.com", "1337d395523a.w.hcaptcha.com", "c01b52459410.w.hcaptcha.com", "gmbux.fun", "myzeroland.com", "niataregister.org", "dogefaucet.click", "js.hcaptcha.com" ], "ips": [ "172.67.128.76", "104.18.12.205", "104.21.22.56", "104.19.229.21", "104.18.13.205", "192.0.78.26", "89.117.188.43", "198.177.125.68", "159.198.74.107", "188.114.96.12", "172.67.132.146", "172.67.202.248", "162.0.208.108", "172.67.192.219", "188.114.97.3" ], "asns": [ "13335", "2635", "47583", "22612" ], "countries": [ "US", "IN" ], "link_domains": [ "cryptofaucet.cc", "adtether.cc", "adbitcoin.cc", "freebtc.best", "www.hcaptcha.com", "hcaptcha.com", "cryptocoinsad.com" ], "doc_hash": "e9c30093024be5565d531256d69ad1cad5e69627f931d1f03d9671699f62b4a6", "script_hashes": [ "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8", "d60b4181cdd9e02ce23553608c79842a3ad8a2acbbd90e31d6c562fc20feca5c" ], "globals": [ "tailwind", "/template.html", "Raven", "hcaptcha", "startTimer", "handleAuth", "openClaimModal", "closeClaimModal", "openStatsModal", "closeStatsModal", "openRefModal", "closeRefModal", "switchStatsTab", "loadStatsData", "submitClaim", "requestWithdraw", "logout", "grecaptcha", "countdownInterval", "timeLeft", "claimWidgetId", "currentTab", "getBrowserFP" ], "cookies": [ "PHPSESSID", "__cf_bm", "cf_clearance" ], "tls": { "san": [ "freeusdt.best", "*.freeusdt.best" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "freeusdt.best", "protocol": "QUIC", "valid_to": "2027-01-01T09:28:11Z", "valid_from": "2026-10-03T08:29:34Z" }, "domain_age_days": 148, "apex_age_days": 148, "tls_age_days": 29, "tls_valid_days": 90, "requests": 80, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.1.34", "content-security-policy": "frame-ancestors *;", "x-content-type-options": "nosniff", "priority": "u=0,i" } }, "cf": { "v": 1, "fetched_at": "2026-11-02T08:23:41Z", "uuid": "75ce77d5-725e-43db-9d8f-ced5f31d2ed6", "scanned_at": "2026-11-02T08:22:32Z", "final_url": "https://freeusdt.best/", "status": 200, "history": [ { "url": "https://freeusdt.best/", "status": 200 } ], "dom_hash": "036d9f2067415b524120d81cb37acc96c46e7a7f3ad8a556e1915d742e3da392", "doc_hash": "1007a3b555ee271d254b66fc535df8df577532ac7c0f95635666579c48a59f0b", "domain_risks": [ "Economy & Finance", "Business & Economy" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "freeusdt.best", "type": "A", "value": "172.67.155.163" }, { "name": "freeusdt.best", "type": "A", "value": "104.21.72.221" }, { "name": "freeusdt.best", "type": "AAAA", "value": "2606:4700:3037::6815:48dd" }, { "name": "freeusdt.best", "type": "AAAA", "value": "2606:4700:3034::ac43:9ba3" } ], "dnssec_valid": false, "ip": "127.0.1.33", "whois": { "registrar": "Spaceship, Inc.", "created": "2026-06-07T06:03:57Z", "updated": "2026-07-03T14:09:04Z", "expires": "2027-06-07T23:59:59Z", "nameservers": [ "dawn.ns.cloudflare.com", "mario.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-11-02T09:26:11Z", "analysis_at": "2026-11-02T03:35:06Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 1, "suspicious": 4, "undetected": 34 }, "detections": { "Webroot": "malicious", "SOCRadar": "suspicious", "Gridinsoft": "suspicious", "alphaMountain.ai": "suspicious", "Forcepoint ThreatSeeker": "suspicious" }, "reputation": 0, "created": "2026-06-07T00:00:00Z", "first_seen": "2026-06-07T06:44:37Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::ac43:9ba3" }, { "ttl": 300, "type": "A", "value": "172.67.155.163" }, { "ttl": 300, "type": "A", "value": "104.21.72.221" }, { "ttl": 21600, "type": "NS", "value": "mario.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "dawn.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 ip4:164.5.249.17 a mx ~all" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "dawn.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:48dd" } ], "dns_at": "2026-11-02T05:30:27Z", "jarm": "27d40d40d00040d1dc27d40d27d40d5fb4c89fe3813d172ffb53f84a68f750", "cert": { "san": [ "freeusdt.best", "*.freeusdt.best" ], "issuer": "Google Trust Services / WE1", "serial": "d82e032814de96300ef4d3cb5dea722d", "sha256": "b22c8250c0a36125f0021908339c84132860022236e5970d822d64d5091d4092", "subject": "freeusdt.best", "valid_to": "2027-01-01T09:28:11Z", "valid_from": "2026-10-03T08:29:34Z" }, "whois": [] }, "webcheck": { "v": 1, "fetched_at": "2026-11-02T07:55:58Z", "mail_config": { "spf": "v=spf1 ip4:164.5.249.17 a mx ~all", "dkim": [ "dkim" ], "dkim_bits": 1024, "spf_lookups": 2 }, "caa_records": { "domain": "freeusdt.best" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-11-02T07:49:14Z", "first": "2026-11-02T07:49:14Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 10624 }, "trackers": { "requests": 102, "trackers": [ { "name": "AnonymousAds", "company": "AnonymousAds", "category": "Advertising", "requests": 12 }, { "name": "Tawk", "company": "Tawk", "country": "US", "category": "Customer Interaction", "requests": 1 }, { "name": "Bootstrap CDN", "company": "BootstrapCDN", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 7 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 1 }, { "name": "blogspot.com", "company": "Google", "country": "US", "category": "Misc", "requests": 1 }, { "name": "hCaptcha", "company": "Intuition Machines", "country": "US", "category": "Utilities", "requests": 10 } ] }, "tls_connection": { "alpn": "h2", "cipher": "ECDHE-ECDSA-AES128-GCM-SHA256", "protocol": "TLSv1.2", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "dns_server": { "ns": [ { "ip": "108.162.193.203", "host": "mario.ns.cloudflare.com" }, { "ip": "173.245.58.106", "host": "dawn.ns.cloudflare.com" } ], "zone": "freeusdt.best" }, "location": { "ip": "2606:4700:3034::ac43:9ba3", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "freeusdt.best" }, "dns": { "A": [ "172.67.155.163", "104.21.72.221" ], "NS": [ "dawn.ns.cloudflare.com", "mario.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"dawn.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416522267, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "v=spf1 ip4:164.5.249.17 a mx ~all" ], "AAAA": [ "2606:4700:3037::6815:48dd", "2606:4700:3034::ac43:9ba3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3037::6815:48dd", "family": 6 }, "subdomains": { "count": 1, "subdomains": [ "www.freeusdt.best" ] }, "whois": { "registrar": "Spaceship, Inc.", "created": "2026-06-07T06:03:57Z", "updated": "2026-07-03T14:09:04Z", "expires": "2027-06-07T23:59:59Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "dawn.ns.cloudflare.com", "mario.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "content-security-policy": "default-src 'none'; script-src 'nonce-XNfA2sUWcObusdXvuKL1xW' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenge", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "same-origin", "permissions-policy": "accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*", "cross-origin-opener-policy": "same-origin", "cross-origin-resource-policy": "same-origin", "cross-origin-embedder-policy": "require-corp" } } } } ``` ## Complete dated records Availability observations: https://phishdestroy.io/domain/freeusdt.best/records.json?source=availability&format=json Source observation history: https://phishdestroy.io/domain/freeusdt.best/records.json?source=detections&format=json PhishStats records: https://phishdestroy.io/domain/freeusdt.best/records.json?source=phishstats&format=json Sent report records: https://phishdestroy.io/domain/freeusdt.best/records.json?source=sent_reports&format=json Report history: https://phishdestroy.io/domain/freeusdt.best/records.json?source=report_history&format=json Repeat report records: https://phishdestroy.io/domain/freeusdt.best/records.json?source=rereports&format=json Follow-up records: https://phishdestroy.io/domain/freeusdt.best/records.json?source=followups&format=json Content observations: https://phishdestroy.io/domain/freeusdt.best/records.json?source=content&format=json ## Dated availability observation The latest stored response was inconclusive ```json { "state": "unknown", "label_key": "availability.unverified", "detail_key": "detail.inconclusive", "params": [], "source": "current_state_backfill", "record_id": 1741719, "scope": "checked_url", "observed_at": "2026-11-02T07:48:23Z", "http_status": null, "http_observed_at": "2026-11-02T07:48:23Z", "stored_http_code": null, "stored_http_observed_at": "2026-11-02T07:48:23Z", "legacy_site_status": "alive", "supports_outcome_badge": false, "content_classification": "unknown", "content_classification_at": null, "registration_state": "unknown", "policy": "20261102-dated-availability-v1" } ```