# PhishDestroy threat dossier — geckoz.digital
================================================================

Fetched:   2026-07-28 10:22:25 UTC
Canonical: https://phishdestroy.io/domain/geckoz.digital/

## VERDICT
----------------------------------------------------------------
CRITICAL THREAT — DO NOT VISIT
Composite threat score: 100/100 (PhishDestroy scoring — see methodology below)

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      15/91 security vendors flagged this domain
  Flagging vendors: ADMINUSLabs, alphaMountain.ai, AlphaSOC, BitDefender, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, SOCRadar, Sophos, VIPRE, Webroot
AlienVault OTX:  4 pulses (threat-intel feed mentions)
Public blocklists: listed on 1 independent blocklist

## INFRASTRUCTURE
----------------------------------------------------------------
Registrar:       MarkMonitor Inc.
Nameservers:     ["ns911b.microsoftinternetsafety.net", "ns911a.microsoftinternetsafety.net"]
HTTP response:   302

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: pending notification queue. No abuse reports filed yet — this domain is
waiting for the next cycle of our automated abuse-reporter.

## TIMELINE
----------------------------------------------------------------
First detected:    2026-07-26 08:23:08 UTC (by PhishDestroy tracker)
Last verified:     2026-07-28 12:20:32 UTC
Current status:    ACTIVE / observable

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-07-26 08:24:31 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

geckoz.digital — Generic Phishing Investigation

Analysis of geckoz.digital indicates an active generic phishing campaign that remains operational as of July 26, 2026. The domain is registered through MarkMonitor Inc., a registrar frequently associated with high‑value brand protection services, which may be leveraged to lend credibility to the malicious infrastructure. DNS resolution is served by ns911a.microsoftinternetsafety.net and ns911b.microsoftinternetsafety.net, suggesting the use of a third‑party hosting provider that offers Microsoft‑branded name‑server services, a pattern observed in other phishing deployments to obscure true ownership. VirusTotal scans have recorded detections from 15 of 91 security vendors, confirming that multiple commercial and open‑source tools have identified malicious characteristics associated with the domain.

HTTP requests to the site return a 302 redirect, a common technique used to funnel victims through intermediate landing pages or to evade static analysis. The domain is listed on at least one external security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, reinforcing the consensus that it poses a credible threat. Current intelligence does not include details on the underlying web content, SSL certificate, hosting IP address, or any observed payload, leaving those vectors unverified. Defenders should therefore treat any traffic to geckoz.digital as hostile.

Recommended actions include adding the domain to outbound filtering rules, ensuring that URL filtering solutions reference the known blocklist entries, and monitoring for any new resolution records that could indicate additional infrastructure. Continuous re‑scanning with multi‑vendor platforms such as VirusTotal is advised to capture any evolution in detection signatures.

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (operator takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/geckoz.digital/
JSON API:          https://api.destroy.tools/v1/check?domain=geckoz.digital
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: independent open-source threat-intelligence platform.
Tracked: 210,392 domains (93,543 alive under monitoring, 115,818 confirmed takedowns/dead). Site: https://phishdestroy.io