# PhishDestroy domain threat record: gbdyltf.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/gbdyltf.com/ Machine-readable companion: https://phishdestroy.io/domain/gbdyltf.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-28 03:30:14 UTC - Last availability or vendor check: 2026-10-28 12:13:33 UTC - Stored record updated: 2026-10-28 12:13:33 UTC - VirusTotal detections in the stored snapshot: 14/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: Gname.com Pte. Ltd. - Registrar country in stored WHOIS data: CN - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2012-01-13 08:28:28 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1808f-683d-77db-b154-2ec651dd56c7/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/gbdyltf.com - Certificate Transparency search: https://crt.sh/?q=%25.gbdyltf.com - Web Archive lookup: https://web.archive.org/web/*/https://gbdyltf.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed gbdyltf.com as a suspicious domain based on an intake rule that flagged multiple VirusTotal detections. The site was first observed by PhishDestroy on 2026-10-28. An HTTP request on that date returned a 200 status code and the recorded page title was “天天看片影院”. How the scam works The detections suggest the site may be used for phishing or other fraudulent activities, but no specific credential‑stealing form or wallet‑draining behavior was observed on the captured page. In general, domains flagged for phishing present deceptive content to lure users into revealing personal or financial information. Evidence VirusTotal scanned the domain on 2026-10-24 (retrieved 2026-10-28) and reported 14 detections: 13 malicious and 1 suspicious across 92 engines. Google Safe Browsing checked on 2026-10-28 and did not flag the site. urlscan captured the page on 2026-07-03 and gave an overall clean verdict, though its engine scoring marked it malicious with a score of 72. OTX listed four pulses referencing the domain, and no external blocklists reported it as malicious at the time of checking. Infrastructure The domain was registered on 2012-01-13 through Gname.com Pte. Ltd. and is protected by Cloudflare, resolving to IP 188.114.97.3 in the CloudFLARENET-EU network (recorded country GB). TLS is provided by a Let's Encrypt certificate valid until 2027-01-02. Additional IPs observed in scans include 172.67.153.40 and others associated with Cloudflare edge nodes. What to do Visitors should avoid entering any credentials, personal data, or downloading files from this site; if any information was submitted, change passwords and monitor accounts for suspicious activity. Organizations can block the domain at the DNS or proxy level and review logs for connections to the recorded IP addresses. Continue to monitor threat‑intel feeds for any updates on the domain’s status. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1808f-683d-77db-b154-2ec651dd56c7/ Cloudflare Radar report: https://radar.cloudflare.com/scan/bcb124ce-2d78-4622-94cb-605e88710f01 URLQuery report: https://urlquery.net/report/cfa73fdd-e49f-4914-9ac6-2270edaed842 Stored capture screenshot: https://i.ibb.co/Zj8m8SH/1bf1ddba50f9.png Cloudflare Radar screenshot (2026-10-28T03:33:11Z): https://screenshots.phishdestroy.io/cf/bcb124ce-2d78-4622-94cb-605e88710f01.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/cfa73fdd-e49f-4914-9ac6-2270edaed842.png URLScan screenshot (2026-06-23T07:21:12Z): https://screenshots.phishdestroy.io/us/019ef35a-a964-7210-9aa8-c4734b9017e9.png URLScan capture report: https://urlscan.io/result/019ef35a-a964-7210-9aa8-c4734b9017e9/ URLScan screenshot (2026-06-30T08:09:45Z): https://screenshots.phishdestroy.io/us/019f1793-861c-7723-bff1-72f22f4ffad1.png URLScan capture report: https://urlscan.io/result/019f1793-861c-7723-bff1-72f22f4ffad1/ URLScan screenshot (2026-06-30T09:38:16Z): https://screenshots.phishdestroy.io/us/019f17e3-b325-71cf-835b-821fa323a583.png URLScan capture report: https://urlscan.io/result/019f17e3-b325-71cf-835b-821fa323a583/ URLScan screenshot (2026-06-30T13:24:50Z): https://screenshots.phishdestroy.io/us/019f18b3-c98f-721e-8496-82af73af624d.png URLScan capture report: https://urlscan.io/result/019f18b3-c98f-721e-8496-82af73af624d/ URLScan screenshot (2026-06-30T15:20:46Z): https://screenshots.phishdestroy.io/us/019f191e-3e38-71ef-933a-ccf171757d7e.png URLScan capture report: https://urlscan.io/result/019f191e-3e38-71ef-933a-ccf171757d7e/ URLScan screenshot (2026-07-03T08:00:40Z): https://screenshots.phishdestroy.io/us/019f26fe-5766-7688-85e9-367c85a74a0d.png URLScan capture report: https://urlscan.io/result/019f26fe-5766-7688-85e9-367c85a74a0d/ VirusTotal report: https://www.virustotal.com/gui/domain/gbdyltf.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gbdyltf.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-28 04:05:09 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Zj8m8SH/1bf1ddba50f9.png Captured: 2026-10-28 03:31:43 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a1808f-683d-77db-b154-2ec651dd56c7.png Captured: 2026-10-28 03:31:43 UTC Source report: https://urlscan.io/result/01a1808f-683d-77db-b154-2ec651dd56c7/ - URLScan · 2026-07-03: https://screenshots.phishdestroy.io/us/019f26fe-5766-7688-85e9-367c85a74a0d.png Captured: 2026-07-03 08:00:40 UTC Source report: https://urlscan.io/result/019f26fe-5766-7688-85e9-367c85a74a0d/ SHA-256: 612eaa6adae7ab36a4c939fe984e8622613d443fb137a2891080e18d05484c35 - URLScan · 2026-06-23: https://screenshots.phishdestroy.io/us/019ef35a-a964-7210-9aa8-c4734b9017e9.png Captured: 2026-06-23 07:21:12 UTC Source report: https://urlscan.io/result/019ef35a-a964-7210-9aa8-c4734b9017e9/ SHA-256: eb1cb9ff8c764b7544178b41874d6267a50367cbd40b68e00d984faf2cad8ba0 - URLScan · 2026-06-30: https://screenshots.phishdestroy.io/us/019f1793-861c-7723-bff1-72f22f4ffad1.png Captured: 2026-06-30 08:09:45 UTC Source report: https://urlscan.io/result/019f1793-861c-7723-bff1-72f22f4ffad1/ SHA-256: 4034b81fc08ba9d1e396ebda1f5b9b769624c386ce06f20ef466f8b1896c2c61 - URLScan · 2026-06-30: https://screenshots.phishdestroy.io/us/019f17e3-b325-71cf-835b-821fa323a583.png Captured: 2026-06-30 09:38:16 UTC Source report: https://urlscan.io/result/019f17e3-b325-71cf-835b-821fa323a583/ SHA-256: 4034b81fc08ba9d1e396ebda1f5b9b769624c386ce06f20ef466f8b1896c2c61 - URLScan · 2026-06-30: https://screenshots.phishdestroy.io/us/019f18b3-c98f-721e-8496-82af73af624d.png Captured: 2026-06-30 13:24:50 UTC Source report: https://urlscan.io/result/019f18b3-c98f-721e-8496-82af73af624d/ SHA-256: 4034b81fc08ba9d1e396ebda1f5b9b769624c386ce06f20ef466f8b1896c2c61 - URLScan · 2026-06-30: https://screenshots.phishdestroy.io/us/019f191e-3e38-71ef-933a-ccf171757d7e.png Captured: 2026-06-30 15:20:46 UTC Source report: https://urlscan.io/result/019f191e-3e38-71ef-933a-ccf171757d7e/ SHA-256: 4034b81fc08ba9d1e396ebda1f5b9b769624c386ce06f20ef466f8b1896c2c61 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/bcb124ce-2d78-4622-94cb-605e88710f01.png Captured: 2026-10-28 03:33:11 UTC Source report: https://radar.cloudflare.com/scan/bcb124ce-2d78-4622-94cb-605e88710f01 SHA-256: 866fd1c88a643df19247e2c261b2d2fa511348a1a686d47617fec35802ae2f05 - URLQuery: https://screenshots.phishdestroy.io/uq/cfa73fdd-e49f-4914-9ac6-2270edaed842.png Source report: https://urlquery.net/report/cfa73fdd-e49f-4914-9ac6-2270edaed842 SHA-256: 2d91c935668eaac96c04ef08dfbf453c0a8f2a2029bb37592e7ceda600006d44 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-28T03:33:46Z", "uuid": "01a1808f-683d-77db-b154-2ec651dd56c7", "scanned_at": "2026-10-28T03:31:03Z", "final_url": "https://gbdyltf.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://gbdyltf.com/", "from": "http://gbdyltf.com/", "status": 307 } ], "ip": "172.67.153.40", "domains": [ "pic.niuniuzy.info", "hhmage.com", "node92.aizhantj.com", "img.lzipic.com", "node95.aizhantj.com", "static.cloudflareinsights.com", "transwww.gbdyltf.com", "img.liangzipic.com", "node90.aizhantj.com", "block.banner5.com" ], "ips": [ "43.169.32.101", "104.16.80.73", "74.113.236.130", "172.67.157.82", "185.13.109.144", "172.67.153.40" ], "asns": [ "139341", "13335", "47191", "7488" ], "countries": [ "SG", "VG", "US" ], "doc_hash": "ad8f9107eed4a59f6e05aacdf05ee904f33f1b9d1a38c339a360ebbb243e637a", "script_hashes": [ "4ba49ab1972ef86973641fbe0fd8b37ae8efee3734dd7e8abe92fac5f042b022", "2af019e8171311adc7e95cf15884d07229db9437b02ac8dae2a44c588133a084", "05538f301499d98295f66033d6139607f5b1f779fda2a377a4f97e4d9e3417d0", "4a4de7903ea62d330e17410ea4db6c22bcbeb350ac6aa402d6b54b4c0cbed327", "bb8bd917fcf399803db31c116d8af76e29a5db16bf342e027971672a598f6f38", "f74f45da0b5fc120cd272effa2ad9971c336b68b9af2fa3f4a4ae8280d23a0b2", "7e97201eb855701cc75e6bbbaad53a8164b6e223736292554486561b4fd9c058", "23128d5ef21bb76869c51d759d245edc9be961b27991236e35d4f8b6ba2c5b10", "1a52c16e5a7fc905630d52185ca457108cb0a65a4567cf6157709c1c5eceb311", "c271d2af48db29f098f901ea91cf51a301a07520287ed62951ad8fcb7dae6867" ], "globals": [ "__SITE_STATIC_URLS__", "_mtj", "__SITE_ADS_DISABLED__", "$", "jQuery", "lazyloadImg", "jQuery111308719540505595141", "setTab", "_0xodj", "_0xe7eef4", "_0x4344", "_0x3edd", "Swiper", "AJAX", "checkAll", "checkOthers", "textareasize", "set", "view", "hide", "getScroll", "HtmlEncode", "getElementsByName", "closeWin", "openWindow", "openWindow2", "selectTogg", "checkInput", "copyToClipboard", "getUrlArgs", "ajax", "reportErr", "AddFav", "viewComment", "submitComment", "diggVideo", "treadVideo", "diggNews", "treadNews", "alertFrontWin" ], "cookies": [ "Hm_tf_i4eou2blskb", "Hm_lvt_i4eou2blskb", "Hm_lpvt_i4eou2blskb", "Hm_tf_lkecjpzgnsm", "Hm_lvt_lkecjpzgnsm", "Hm_lpvt_lkecjpzgnsm" ], "storage_keys": [ "Hm_lpvt_i4eou2blskb", "Hm_tf_i4eou2blskb", "Hm_lvt_i4eou2blskb", "Hm_lpvt_lkecjpzgnsm", "Hm_tf_lkecjpzgnsm", "Hm_lvt_lkecjpzgnsm" ], "tls": { "san": [ "*.gbdyltf.com", "gbdyltf.com" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "gbdyltf.com", "protocol": "QUIC", "valid_to": "2027-01-02T10:41:25Z", "valid_from": "2026-10-04T10:41:26Z" }, "domain_age_days": 1351, "apex_age_days": 1351, "tls_age_days": 23, "tls_valid_days": 89, "requests": 77, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 72, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-powered-by": "Express" } }, "cf": { "v": 1, "fetched_at": "2026-10-28T03:33:50Z", "uuid": "bcb124ce-2d78-4622-94cb-605e88710f01", "scanned_at": "2026-10-28T03:33:11Z", "final_url": "https://ksj259.top/verify/fd75b39a", "status": 200, "history": [ { "url": "https://gbdyltf.com/", "status": 200 }, { "url": "https://ksj259.top/", "status": 302 }, { "url": "https://ksj259.top/verify/fd75b39a", "status": 200 } ], "dom_hash": "107a93d1f90af6bc7846f8b0d9c8ebd441d1159d65fae9421a2428fc04b9de48", "doc_hash": "890fd5219045bababbd42590c75598c303f3dbc5a00ceda2ee7ff3dc9fce2b8a", "phishing_v2": [ "phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "ksj259.top", "type": "A", "value": "172.67.142.13" }, { "name": "ksj259.top", "type": "A", "value": "104.21.63.10" }, { "name": "ksj259.top", "type": "AAAA", "value": "2606:4700:3032::6815:3f0a" }, { "name": "ksj259.top", "type": "AAAA", "value": "2606:4700:3036::ac43:8e0d" } ], "dnssec_valid": false, "ip": "127.0.1.66", "whois": { "registrar": "NameSilo,LLC", "created": "2026-10-26T07:46:26Z", "updated": "2026-10-26T07:46:28Z", "expires": "2027-10-26T07:46:26Z", "nameservers": [ "donovan.ns.cloudflare.com.", "violet.ns.cloudflare.com." ] } }, "vt": { "v": 1, "fetched_at": "2026-10-28T04:04:29Z", "analysis_at": "2026-10-24T00:09:31Z", "stats": { "timeout": 0, "harmless": 45, "malicious": 13, "suspicious": 1, "undetected": 33 }, "detections": { "DNS8": "phishing", "ESET": "phishing", "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "spam", "Seclookup": "malicious", "Gridinsoft": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "malicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "categories": { "Sophos": "phishing and fraud", "Webroot": "Phishing and Other Frauds", "alphaMountain.ai": "Malicious (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds" }, "registrar": "Gname.com Pte. Ltd.", "created": "2012-01-13T09:28:28Z", "expires": "2027-01-13T09:28:28Z", "updated": "2026-09-27T07:08:13Z", "first_seen": "2023-10-26T18:10:27Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "cruz.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:20ad" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "bob.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.153.40" }, { "ttl": 300, "type": "A", "value": "104.21.32.173" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::ac43:9928" }, { "ttl": 21600, "type": "NS", "value": "bob.ns.cloudflare.com" } ], "dns_at": "2026-10-24T00:09:50Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.gbdyltf.com", "gbdyltf.com" ], "issuer": "Let's Encrypt / YE1", "serial": "64bf8556f68e000cbcab4b834b48de4711b", "sha256": "b614554e579079be7c3b9e9576bdf14b29d9230c92295735f97fa42bffbe7271", "subject": "gbdyltf.com", "valid_to": "2027-01-02T10:41:25Z", "valid_from": "2026-10-04T10:41:26Z" }, "whois": { "registrar": "Gname.com Pte. Ltd.", "registrar_iana_id": "1923", "registrar_url": "http://www.gname.com", "created": "2012-01-13T09:28:28Z", "updated": "2026-09-13T07:08:12Z", "expires": "2027-01-13T09:28:28Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "a2.share-dns.com", "b2.share-dns.net" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-01-13T09:28:28Z", "registration": "2012-01-13T09:28:28Z", "last update of RDAP database": "2026-10-18T11:38:06Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-28T03:33:27Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "gbdyltf.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-28T03:30:35Z", "first": "2012-11-02T15:08:28Z", "changes": 27, "days_archived": 40, "scans_per_day": 0.01, "avg_page_bytes": 6844 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://gbdyltf.com/index.php/rss/baidu.xml", "https://gbdyltf.com/viewhtml.xml" ] }, "sitemap": { "present": true, "url_count": 30 }, "social_tags": { "keywords": "天天看片影院", "description": "天天看片影院" }, "trackers": { "requests": 44 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 51, "tls": 64, "wait": 41, "connect": 7, "download": 12 }, "response_ms": 175 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 139313, "co2_grams": 0.0051, "cleaner_than": 15 }, "dns_server": { "ns": [ { "ip": "173.245.58.88", "host": "cruz.ns.cloudflare.com" }, { "ip": "108.162.193.104", "host": "bob.ns.cloudflare.com" } ], "zone": "gbdyltf.com" }, "cookies": { "cookies": [ { "name": "_slide_passed", "secure": true, "same_site": "Lax" } ] }, "location": { "ip": "2a06:98c1:3121::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "gbdyltf.com" }, "dns": { "A": [ "188.114.97.3", "188.114.96.3" ], "NS": [ "cruz.ns.cloudflare.com", "bob.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"bob.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416609175, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3120::3", "2a06:98c1:3121::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::3", "family": 6 }, "redirects": { "chain": [ "https://gbdyltf.com" ] }, "subdomains": { "count": 1, "subdomains": [ "www.gbdyltf.com" ] }, "linked_pages": { "internal_count": 464 }, "whois": { "registrar": "Gname.com Pte. Ltd.", "created": "2012-01-13T09:28:28Z", "updated": "2026-10-04T11:38:05Z", "expires": "2027-01-13T09:28:28Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "bob.ns.cloudflare.com", "cruz.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-powered-by": "Express" } } } } ```