# PhishDestroy domain threat record: gaddaficvv.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/gaddaficvv.com/
Machine-readable companion: https://phishdestroy.io/domain/gaddaficvv.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-23 08:13:55 UTC
- Last availability or vendor check: 2026-10-22 10:16:28 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 4/91
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Internet Domain Service BS Corp.
- Registrar country in stored WHOIS data: NG
- Last stored HTTP status: 403
- Registration date (registry RDAP, gaddaficvv.com): 2026-07-31 21:21:02 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0cd52-c8ef-731a-b475-500ee57f29a1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/gaddaficvv.com
- Certificate Transparency search: https://crt.sh/?q=%25.gaddaficvv.com
- Web Archive lookup: https://web.archive.org/web/*/https://gaddaficvv.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
gaddaficvv.com carries the page title "GADDAFICVV" and presents itself as that service. PhishDestroy classifies it as an impersonation phishing page aimed at people looking for the GADDAFICVV brand, many of whom arrive ready to log in or pay in crypto. We first flagged the domain on 2026-09-23. As of 2026-10-19 it was still online, with its content served from behind a protective front layer.

How the scam works
Impersonation sites like this copy a brand's name and look so visitors trust them on sight. The victim is asked to sign in, create an account or top up a balance, usually in cryptocurrency. Credentials typed into the page go straight to the operators. Any deposit lands in a wallet they control and cannot be pulled back, and what was paid for is never delivered. Because MetaMask and SEAL both list the domain, crypto users are clearly among the people it targets.

Evidence
Four of 91 VirusTotal engines flagged the domain at the 2026-10-06 check: alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. That count is modest, so many browsers and security tools will not warn on it yet. The stronger signal comes from crypto-focused blocklists. Besides PhishDestroy, the domain appears on the MetaMask and SEAL lists. Four AlienVault OTX threat pulses also reference it, so other researchers have tracked it independently.

Infrastructure
The domain was registered on 2026-07-31 through Internet Domain Service BS Corp., about 54 days before we detected it. That gap leaves time to build the page and start drawing traffic before blocklists catch up. The site sits behind Cloudflare (US network), so its real origin server is hidden. It also runs on a free Let's Encrypt certificate, which means the padlock shows only an encrypted connection and says nothing about who runs the site.

What to do
If you entered a username, password or email on this site, change that password everywhere you reused it and turn on two-factor authentication. Do not send any further payments, even if the site asks for a fee to unlock a balance or an order. If you connected a wallet, revoke any token approvals granted during the visit and move remaining funds to a fresh address. Keep transaction hashes in case you report the theft. Defenders should block gaddaficvv.com at DNS and the web proxy, and add it to mail and chat filters.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0cd52-c8ef-731a-b475-500ee57f29a1/
VirusTotal report: https://www.virustotal.com/gui/domain/gaddaficvv.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gaddaficvv.com
Archived copy: https://web.archive.org/web/20260923081518/https://gaddaficvv.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:35:56 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/8L7DkvDP/6320835a2826.png
  Captured: 2026-09-23 08:13:55 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0cd52-c8ef-731a-b475-500ee57f29a1.png
  Captured: 2026-09-23 08:13:55 UTC
  Source report: https://urlscan.io/result/01a0cd52-c8ef-731a-b475-500ee57f29a1/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/095122af-4e8a-41b0-a124-f163aea9ed86.png
  Captured: 2026-09-23 08:46:31 UTC
  Source report: https://radar.cloudflare.com/scan/095122af-4e8a-41b0-a124-f163aea9ed86
  SHA-256: e7abd1d4c858d07369ab85d5fc1d9a078b2d271bd6cbeb316e842be1a6a067bb
- URLQuery: https://screenshots.phishdestroy.io/uq/dee4cd9a-5b78-4148-aa62-9c0db30a0ab8.png
  Source report: https://urlquery.net/report/dee4cd9a-5b78-4148-aa62-9c0db30a0ab8
  SHA-256: 01ee420ab3a91c7328f114fdfe36a4f45d68333a7ad2d5c11294fbfa55ba4523
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cd53-4673-764d-9cdf-060e82e0626e.png
  Captured: 2026-09-23 08:13:08 UTC
  Source report: https://urlscan.io/result/01a0cd53-4673-764d-9cdf-060e82e0626e/
  SHA-256: 084b6f7fa7c633188f4211f38ec8a085e156d25b3d1532a3d88b12306922cc4a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T21:02:13Z",
        "uuid": "01a0cd52-c8ef-731a-b475-500ee57f29a1",
        "scanned_at": "2026-09-23T08:12:35Z",
        "final_url": "https://gaddaficvv.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://gaddaficvv.com/",
                "from": "http://gaddaficvv.com/",
                "status": 307
            }
        ],
        "ip": "188.114.96.3",
        "domains": [
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "104.16.80.73",
            "188.114.96.3"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "b43d21be2284b043dd6a35addc22572ef2cd968a9440a395ea054c080e5fb276",
        "script_hashes": [
            "7246772e9802d5f115d41125f911c8c422cd8cbe253967594b132a166b1b397d"
        ],
        "globals": [
            "__cfBeacon"
        ],
        "tls": {
            "san": [
                "*.gaddaficvv.com",
                "gaddaficvv.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "gaddaficvv.com",
            "protocol": "QUIC",
            "valid_to": "2026-12-19T16:23:26Z",
            "valid_from": "2026-09-20T16:23:27Z"
        },
        "domain_age_days": 2,
        "apex_age_days": 2,
        "tls_age_days": 2,
        "tls_valid_days": 89,
        "requests": 11,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/8.3.33",
            "content-security-policy": "upgrade-insecure-requests"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:08:19Z",
        "uuid": "095122af-4e8a-41b0-a124-f163aea9ed86",
        "scanned_at": "2026-09-23T08:46:31Z",
        "final_url": "https://gaddaficvv.com/",
        "status": 200,
        "history": [
            {
                "url": "https://gaddaficvv.com/",
                "status": 200
            }
        ],
        "dom_hash": "54817fa70b03fa3d1415ec56ed491ba51994088ddc24d01eb216b4a0e372cc2c",
        "doc_hash": "1ec54cb88e850916b02713f2fca629a57e6eae7d9f5bc1b26eb1290453932447",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "New Domains",
            "Security Risks",
            "Newly Seen Domains",
            "DGA Domains",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "gaddaficvv.com",
                "type": "A",
                "value": "172.67.219.173"
            },
            {
                "name": "gaddaficvv.com",
                "type": "A",
                "value": "104.21.45.226"
            },
            {
                "name": "gaddaficvv.com",
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:dbad"
            },
            {
                "name": "gaddaficvv.com",
                "type": "AAAA",
                "value": "2606:4700:3033::6815:2de2"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.219.173",
        "verdict": {
            "tags": [
                "dga domains"
            ],
            "malicious": true,
            "categories": [
                "dga domains"
            ]
        },
        "whois": {
            "registrar": "Internet Domain Service BS Corp",
            "created": "2026-07-31T21:21:02Z",
            "updated": "2026-09-20T17:19:17Z",
            "expires": "2027-07-31T21:21:02Z",
            "nameservers": [
                "alex.ns.cloudflare.com",
                "marjory.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T21:37:55Z",
        "analysis_at": "2026-10-08T23:46:41Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 1,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)"
        },
        "registrar": "Internet Domain Service BS Corp",
        "created": "2026-07-31T21:21:02Z",
        "expires": "2027-07-31T21:21:02Z",
        "updated": "2026-09-20T17:19:17Z",
        "first_seen": "2026-09-20T18:11:33Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "alex.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:dbad"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.219.173"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::6815:2de2"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "alex.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.45.226"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "marjory.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-08T23:49:38Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.gaddaficvv.com",
                "gaddaficvv.com"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "65b75304216e5550ed0b8cf5b7b03105ad6",
            "sha256": "47b70f7b74125377a25f7b085b292f5e2c4b7df5bc471ee91abd04ef34298695",
            "subject": "gaddaficvv.com",
            "valid_to": "2026-12-19T16:23:26Z",
            "valid_from": "2026-09-20T16:23:27Z"
        },
        "whois": {
            "registrar": "Internet Domain Service BS Corp",
            "registrar_iana_id": "2487",
            "registrar_url": "http://www.internet.bs",
            "created": "2026-07-31T21:21:02Z",
            "updated": "2026-09-20T17:19:17Z",
            "expires": "2027-07-31T21:21:02Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "alex.ns.cloudflare.com",
                "marjory.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-07-31T21:21:02Z",
                "last changed": "2026-09-20T17:19:17Z",
                "registration": "2026-07-31T21:21:02Z",
                "registrar expiration": "2027-07-31T21:21:02Z",
                "last update of RDAP database": "2026-10-08T23:49:38Z"
            }
        }
    }
}
```