# PhishDestroy threat dossier — ftp.amarifirmdynamic-concepts.com ================================================================ Fetched: 2026-07-29 01:04:43 UTC Canonical: https://phishdestroy.io/domain/ftp.amarifirmdynamic-concepts.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 11/91 security vendors flagged this domain Flagging vendors: BitDefender, ESET, Fortinet, G-Data, Kaspersky, Seclookup, SOCRadar, Sophos, URLQuery, VIPRE, Webroot Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- Registrar: NameCheap, Inc. Nameservers: ["ns1.onebuxhosting.com", "ns2.onebuxhosting.com"] HTTP response: 403 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-26 06:13:08 UTC (by PhishDestroy tracker) Last verified: 2026-07-29 02:00:49 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-26 06:14:54 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] ftp.amarifirmdynamic-concepts.com Safety Check — Phishing The domain ftp.amarifirmdynamic-concepts.com is currently classified as a generic phishing site with a high risk rating. Analysis shows that the domain remains active as of the report date, July 26, 2026, and returns an HTTP 403 response for standard requests. Registration data indicates the domain was created through NameCheap, Inc., and it is served by the authoritative name servers ns1.onebuxhosting.com and ns2.onebuxhosting.com. VirusTotal scans have resulted in 11 of 91 security vendors flagging the domain as malicious, demonstrating a moderate consensus among detection engines. The domain also appears on a single external blocklist and is explicitly listed as blocked by the PhishDestroy service. No additional intelligence such as SSL certificate details, page title, or target brand information is presently available, limiting the depth of payload characterization. Because the HTTP 403 response may be used to obscure malicious content until a specific user agent is presented, threat hunters should consider manual retrieval with appropriate tooling to confirm the presence of credential‑stealing pages. The lack of publicly disclosed IP address or hosting ASN prevents a precise attribution of the underlying infrastructure, so network‑level alerts on connections to the identified name servers are recommended. Security teams should prioritize the inclusion of the domain in outbound and inbound firewall deny lists, update DNS sinkhole configurations to null‑route queries, and ensure that endpoint security solutions receive the latest signatures reflecting the 11 vendor detections. Continuous monitoring of the associated name servers and any future VirusTotal or blocklist updates is advised to capture potential changes in the threat posture. Additionally, verify that internal phishing detection feeds are refreshed to incorporate the domain’s presence on the PhishDestroy blocklist. ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/ftp.amarifirmdynamic-concepts.com/ JSON API: https://api.destroy.tools/v1/check?domain=ftp.amarifirmdynamic-concepts.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 208,201 domains (82,886 alive under monitoring, 124,284 confirmed takedowns/dead). Site: https://phishdestroy.io