# PhishDestroy domain threat record: fwu8.6686-vn.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/fwu8.6686-vn.net/
Machine-readable companion: https://phishdestroy.io/domain/fwu8.6686-vn.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-24 00:12:32 UTC
- Last availability or vendor check: 2026-10-26 00:03:33 UTC
- Stored record updated: 2026-10-26 00:03:33 UTC
- VirusTotal detections in the stored snapshot: 2/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: Facebook

## Stored infrastructure

- Observed IP address: 204.194.48.178
- Registrar in stored WHOIS data: Gname.com Pte. Ltd.
- Registrar country in stored WHOIS data: TW,CN
- Last stored HTTP status: 200
- Registration date (registry RDAP, 6686-vn.net): 2026-02-26 13:25:48 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16b47-c465-7138-bfa0-6a9450bf7640/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/fwu8.6686-vn.net
- Certificate Transparency search: https://crt.sh/?q=%25.fwu8.6686-vn.net
- Web Archive lookup: https://web.archive.org/web/*/https://fwu8.6686-vn.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed fwu8.6686-vn.net as a suspicious domain because Google Safe Browsing flagged it for social engineering. The recorded page title was “Facebook”. The domain was first seen by PhishDestroy on 2026-10-24 and returned HTTP 200 on that date.

How the scam works
Social‑engineering domains typically impersonate trusted brands to lure users into entering credentials or personal information. No concrete malicious functionality was observed on the captured page, so the risk is limited to potential credential harvesting.

Evidence
Google Safe Browsing marked the domain as a social‑engineering threat on 2026-10-24. VirusTotal recorded two detections from 92 engines on the same day, with CRDF labeling it malicious and DNS8 labeling it suspicious. URLScan scans captured on 2026-10-23 and 2026-10-24 gave a malicious engine score of 99 while the overall verdict was non‑malicious. Cloudflare Radar classified the site as phishing on 2026-10-24, and PhishDestroy’s internal blocklist contains the domain; external blocklists checked on that date returned zero matches. OTX reported no pulses.

Infrastructure
The recorded IP was 204.194.48.178, which was associated with Turing Group Limited in the United States. The TLS certificate, issued by Let’s Encrypt / YR1, was valid from 2026-10-21 to 2027-01-19 and covered several wildcard subdomains. The domain age was 0 days and the apex registration was 239 days old at the time of observation.

What to do
Visitors should not enter Facebook credentials or personal data on this site; if they have, they should change their Facebook password and review account activity. Defenders can block the exact domain fwu8.6686-vn.net and monitor traffic to the recorded IP address.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16b47-c465-7138-bfa0-6a9450bf7640/
Cloudflare Radar report: https://radar.cloudflare.com/scan/9ec4dba9-306a-4b88-a8ab-a0a1492a966a
URLQuery report: https://urlquery.net/report/d06d7bca-0f7f-48de-a3ed-51b9a78306ec
Stored capture screenshot: https://i.ibb.co/fGHjq9nS/31ccabb68278.png
Cloudflare Radar screenshot (2026-10-24T00:12:55Z): https://screenshots.phishdestroy.io/cf/9ec4dba9-306a-4b88-a8ab-a0a1492a966a.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/d06d7bca-0f7f-48de-a3ed-51b9a78306ec.png
URLScan screenshot (2026-10-23T09:34:57Z): https://screenshots.phishdestroy.io/us/01a1681c-cd3c-703c-8763-bf212533dc5b.png
URLScan capture report: https://urlscan.io/result/01a1681c-cd3c-703c-8763-bf212533dc5b/
URLScan screenshot (2026-10-24T00:15:40Z): https://screenshots.phishdestroy.io/us/01a16b42-e441-757a-8027-55000c04838d.png
URLScan capture report: https://urlscan.io/result/01a16b42-e441-757a-8027-55000c04838d/
URLScan screenshot (2026-10-24T01:06:27Z): https://screenshots.phishdestroy.io/us/01a16b71-b8dc-7789-81d1-8629b6ce2d1e.png
URLScan capture report: https://urlscan.io/result/01a16b71-b8dc-7789-81d1-8629b6ce2d1e/
VirusTotal report: https://www.virustotal.com/gui/domain/fwu8.6686-vn.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=fwu8.6686-vn.net
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-24 01:13:58 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/fGHjq9nS/31ccabb68278.png
  Captured: 2026-10-24 00:21:24 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a16b47-c465-7138-bfa0-6a9450bf7640.png
  Captured: 2026-10-24 00:21:24 UTC
  Source report: https://urlscan.io/result/01a16b47-c465-7138-bfa0-6a9450bf7640/
- URLScan capture 2: https://screenshots.phishdestroy.io/01a1681c-cd3c-703c-8763-bf212533dc5b.png
  Captured: 2026-10-24 00:12:32 UTC
  Source report: https://urlscan.io/result/01a16b47-c465-7138-bfa0-6a9450bf7640/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/9ec4dba9-306a-4b88-a8ab-a0a1492a966a.png
  Captured: 2026-10-24 00:12:55 UTC
  Source report: https://radar.cloudflare.com/scan/9ec4dba9-306a-4b88-a8ab-a0a1492a966a
  SHA-256: d0e174e809f5d877d590dd2809c050aee1741578eb18f1ded95faa99efae18fb
- URLQuery: https://screenshots.phishdestroy.io/uq/d06d7bca-0f7f-48de-a3ed-51b9a78306ec.png
  Source report: https://urlquery.net/report/d06d7bca-0f7f-48de-a3ed-51b9a78306ec
  SHA-256: 39245c9cfe8db06c56d7b112fbdd579a3fca111f234bd7635b4207b5a7534ec7
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a1681c-cd3c-703c-8763-bf212533dc5b.png
  Captured: 2026-10-23 09:34:57 UTC
  Source report: https://urlscan.io/result/01a1681c-cd3c-703c-8763-bf212533dc5b/
  SHA-256: 494303225fd6abf4a9929216094be746acd3229e3d595c3b84aecc927424ef51
- URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16b42-e441-757a-8027-55000c04838d.png
  Captured: 2026-10-24 00:15:40 UTC
  Source report: https://urlscan.io/result/01a16b42-e441-757a-8027-55000c04838d/
  SHA-256: 6c59fbadea38440fa9e35b1de456124b1bff8ed6848b451598a6f42343e1b8a4
- URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16b71-b8dc-7789-81d1-8629b6ce2d1e.png
  Captured: 2026-10-24 01:06:27 UTC
  Source report: https://urlscan.io/result/01a16b71-b8dc-7789-81d1-8629b6ce2d1e/
  SHA-256: 0ac304b99b2529a69b521def76c02b75fc43a431283ced7ca7967093e07b983e

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-24T00:43:06Z",
        "uuid": "01a16b47-c465-7138-bfa0-6a9450bf7640",
        "scanned_at": "2026-10-24T00:20:45Z",
        "final_url": "https://fwu8.6686-vn.net/wap/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://fwu8.6686-vn.net/",
                "from": "http://fwu8.6686-vn.net/",
                "status": 307
            },
            {
                "to": "https://fwu8.6686-vn.net/wap",
                "from": "https://fwu8.6686-vn.net/"
            },
            {
                "to": "https://fwu8.6686-vn.net/wap/",
                "from": "https://fwu8.6686-vn.net/wap",
                "status": 301
            }
        ],
        "ip": "204.194.48.178",
        "domains": [
            "imgtest1.s3.amazonaws.com",
            "acebookonlineshop.cc",
            "mall-test.s3.amazonaws.com"
        ],
        "ips": [
            "16.15.183.52",
            "52.217.168.234",
            "204.194.48.178"
        ],
        "asns": [
            "14618",
            "16509",
            "140869"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "9b1ba1735e5de267ab84ec7a4d6ecdec53f0c70479047850cd9d773353481891",
        "script_hashes": [
            "325f7fff2d0d20187886b062946dfc96d9d2eb9cd001d7598006e5f77cd76b5e",
            "ad7fc79d5c54f415b396e56221b129831286ed77f35b1248ad9d89610bd985d7",
            "ad4a2085c8e9977d18ddbe347dddc35995dbe052bed454d3f8bf5aa78ca54aa4",
            "19995b2d3fccf46eb14f0ccbef3cf636ee91331898449125403dbf8f73883fee",
            "b2ccd1794d47f6b666c66ee0b7e271a422b207888950dd6a69d8a6e4fad14c18",
            "8f9c0032a2f08ea138fda52cc7f881de458e85bc873153c7eddbd65b7c8d9c15",
            "2a50555f08b06ea460ea92cc5e1c3cc70f4324a76c815db485bcfb10023844b2",
            "06b5935168242abf428c2c0e1cc7e85496e0e8bcdd75ac822ef38153ffbcf93c",
            "5cdcbd06ab7073df7ac26fffe3b819226f58336902d2f358d999b35bea48a41f",
            "00075c975212dd0947a35f2558734340e018698ec2af6875276c3bab2db1e83f"
        ],
        "globals": [
            "myEvent",
            "isFlutterInAppWebViewReady",
            "webpackChunkshop",
            "__getSiteName",
            "clearImmediate",
            "setImmediate",
            "VueStorage"
        ],
        "storage_keys": [
            "@@",
            "scroll",
            "SessionStorage_key_Router_Extend_History",
            "upperLevel",
            "lang",
            "maxBuyNum",
            "site_brand",
            "showLoading",
            "index_banner",
            "index_recomendedStoreShopList",
            "index_categoryList",
            "index_productList",
            "index_dailyNewArrivalList",
            "index_recomendedStoreProductList"
        ],
        "tls": {
            "san": [
                "*.6686-vn.net",
                "*.dt68-vn.net",
                "*.ph-tg77.net",
                "*.ph23-ph.net",
                "*.sunny68.net"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "*.ph23-ph.net",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-19T11:48:30Z",
            "valid_from": "2026-10-21T11:48:31Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 239,
        "tls_age_days": 2,
        "tls_valid_days": 89,
        "requests": 182,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-24T00:14:09Z",
        "uuid": "9ec4dba9-306a-4b88-a8ab-a0a1492a966a",
        "scanned_at": "2026-10-24T00:12:55Z",
        "final_url": "https://fwu8.6686-vn.net/",
        "status": 200,
        "history": [
            {
                "url": "https://fwu8.6686-vn.net/",
                "status": 200
            }
        ],
        "dom_hash": "d9e235d4c1af023844ec172e5864ae9bcc1d3f7070c63fbbcc3e503091524938",
        "doc_hash": "9b1ba1735e5de267ab84ec7a4d6ecdec53f0c70479047850cd9d773353481891",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "fwu8.6686-vn.net",
                "type": "A",
                "value": "204.194.48.178"
            }
        ],
        "dnssec_valid": false,
        "ip": "204.194.48.178",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "created": "2026-02-26T13:25:48Z",
            "updated": "2026-10-21T12:22:19Z",
            "expires": "2027-02-26T13:25:48Z",
            "nameservers": [
                "casey.ns.cloudflare.com",
                "desiree.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-24T01:13:06Z",
        "analysis_at": "2026-10-23T14:05:39Z",
        "stats": {
            "timeout": 0,
            "harmless": 0,
            "malicious": 1,
            "suspicious": 1,
            "undetected": 90
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "created": "2026-02-26T00:00:00Z",
        "updated": "2026-02-26T00:00:00Z",
        "first_seen": "2026-10-23T10:02:58Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "204.194.48.178"
            }
        ],
        "dns_at": "2026-10-23T14:10:58Z",
        "jarm": "3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06b",
        "cert": {
            "san": [
                "*.6686-vn.net",
                "*.dt68-vn.net",
                "*.ph-tg77.net",
                "*.ph23-ph.net",
                "*.sunny68.net"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "5a3f4a4d4d0b70adf7e0b826d5e709713ed",
            "sha256": "fc826221b3ddc27e2fe90de97673bedca2fc1d25af815d234ba1c3412c8fe20f",
            "subject": "*.ph23-ph.net",
            "valid_to": "2027-01-19T11:48:30Z",
            "valid_from": "2026-10-21T11:48:31Z"
        },
        "whois": []
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-24T00:14:30Z",
        "caa_records": {
            "domain": "fwu8.6686-vn.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-24T00:13:10Z",
            "first": "2026-10-24T00:13:10Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 2745
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "trackers": {
            "requests": 149,
            "trackers": [
                {
                    "name": "Amazon Web Services",
                    "company": "Amazon",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 31
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 147,
                "wait": 145,
                "connect": 144,
                "download": 1
            },
            "response_ms": 439
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 7297,
            "co2_grams": 0.0003,
            "cleaner_than": 79
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.44.158",
                    "host": "casey.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.34.13",
                    "host": "desiree.ns.cloudflare.com"
                }
            ],
            "zone": "6686-vn.net"
        },
        "location": {
            "ip": "204.194.48.178",
            "asn": "140869",
            "org": "Turing Group Limited",
            "city": "Dallas",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "*.ph23-ph.net"
        },
        "dns": {
            "A": [
                "204.194.48.178"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "204.194.48.178",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://fwu8.6686-vn.net"
            ]
        },
        "subdomains": {
            "count": 1,
            "subdomains": [
                "www.6686-vn.net"
            ]
        },
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "created": "2026-02-26T13:25:48Z",
            "updated": "2026-10-21T12:22:19Z",
            "expires": "2027-02-26T13:25:48Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "casey.ns.cloudflare.com",
                "desiree.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```