# PhishDestroy domain threat record: gxruihang.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/gxruihang.com/
Machine-readable companion: https://phishdestroy.io/domain/gxruihang.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-28 02:12:04 UTC
- Last availability or vendor check: 2026-10-28 11:00:25 UTC
- Stored record updated: 2026-10-28 11:45:03 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 168.76.254.108
- Registrar in stored WHOIS data: Gname.com Pte. Ltd.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2014-09-25 07:10:48 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019f9323-e3ac-74a4-bd43-ae1cec552162/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/gxruihang.com
- Certificate Transparency search: https://crt.sh/?q=%25.gxruihang.com
- Web Archive lookup: https://web.archive.org/web/*/https://gxruihang.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy classified gxruihang.com as suspicious after an intake review highlighted multiple malicious detections from VirusTotal. The domain was first observed by PhishDestroy on 2026-10-28. A request to the site on that date returned HTTP 200 with no page title recorded, and a URLScan capture from 2026-07-24 showed a plain HTTPS redirect and generic HTML content.

How the scam works
The detections reported by VirusTotal and the malicious engine score from URLScan are typical of phishing or domain‑generation‑algorithm (DGA) campaigns that use newly registered domains to host deceptive pages or to evade reputation systems. Because the captured page contained only a generic placeholder and no credential‑collection form, the specific malicious technique employed by this domain cannot be confirmed.

Evidence
VirusTotal analysis on 2026-10-25 recorded 14 malicious and 2 suspicious detections out of 92 engines (16 total detections). Google Safe Browsing checked on 2026-10-28 did not flag the domain. URLScan captured the site on 2026-07-24, assigning a malicious engine score of 44 but returning an overall clean verdict. OTX listed three pulses referencing gxruihang.com as of 2026-10-28, while external blocklists showed zero hits; PhishDestroy’s internal blocklist marks the domain as malicious.

Infrastructure
The domain was registered on 2014-09-25 through Gname.com Pte. Ltd., with a clientTransferProhibited status. DNS records at the time of observation listed an A record of 168.76.254.108, associated with the Free State Education Department network in South Africa, and authoritative nameservers ns1.julydns.com and ns2.julydns.com. TLS was terminated by Cloudflare using a Google Trust Services certificate valid from 2026-09-19 to 2026-12-18, and the HTTP response included security headers such as HSTS and CSP.

What to do
Avoid entering any credentials, personal data, or payment information on gxruihang.com. If credentials were submitted, change the associated passwords immediately and enable multi‑factor authentication. Block the domain at network perimeters, monitor logs for connections to its IP address or Cloudflare endpoints, and continue to watch threat‑intel feeds for any new activity linked to this domain.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019f9323-e3ac-74a4-bd43-ae1cec552162/
Cloudflare Radar report: https://radar.cloudflare.com/scan/b4cdac55-2a35-44e8-99e6-08bacf1c2c36
Stored capture screenshot: https://urlscan.io/screenshots/019f9323-e3ac-74a4-bd43-ae1cec552162.png
URLScan screenshot (2026-07-22T20:52:59Z): https://screenshots.phishdestroy.io/us/019f8b9a-4cde-72a9-9663-ac778fe3a2ce.png
URLScan capture report: https://urlscan.io/result/019f8b9a-4cde-72a9-9663-ac778fe3a2ce/
URLScan screenshot (2026-07-23T01:30:37Z): https://screenshots.phishdestroy.io/us/019f8c98-7c82-733c-b9f3-b4be23e45da1.png
URLScan capture report: https://urlscan.io/result/019f8c98-7c82-733c-b9f3-b4be23e45da1/
URLScan screenshot (2026-07-23T08:00:50Z): https://screenshots.phishdestroy.io/us/019f8dfd-c036-76ac-89ff-e18e8fbaf93c.png
URLScan capture report: https://urlscan.io/result/019f8dfd-c036-76ac-89ff-e18e8fbaf93c/
VirusTotal report: https://www.virustotal.com/gui/domain/gxruihang.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gxruihang.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 03:34:14 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019f9323-e3ac-74a4-bd43-ae1cec552162.png
  Captured: 2026-10-28 02:12:04 UTC
- URLScan capture: https://screenshots.phishdestroy.io/019f9323-e3ac-74a4-bd43-ae1cec552162.png
  Captured: 2026-10-28 04:30:59 UTC
  Source report: https://urlscan.io/result/019f9323-e3ac-74a4-bd43-ae1cec552162/

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-28T02:32:14Z",
        "uuid": "019f9323-e3ac-74a4-bd43-ae1cec552162",
        "scanned_at": "2026-07-24T08:00:44Z",
        "final_url": "https://gxruihang.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://gxruihang.com/",
                "from": "http://gxruihang.com/",
                "status": 307
            }
        ],
        "ip": "104.21.28.149",
        "domains": [
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "104.16.80.73",
            "104.21.28.149"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "82c14b8e2e8c42d826e1ad004814a3eb908bd452f7556bba21157da4bbd831af",
        "globals": [
            "__cfBeacon"
        ],
        "tls": {
            "san": [
                "gxruihang.com",
                "*.gxruihang.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "gxruihang.com",
            "protocol": "QUIC",
            "valid_to": "2026-10-20T18:37:57Z",
            "valid_from": "2026-07-22T17:39:33Z"
        },
        "domain_age_days": 1255,
        "apex_age_days": 1255,
        "tls_age_days": 1,
        "tls_valid_days": 90,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 44,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=63072000; includeSubDomains",
            "content-security-policy": "object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'",
            "x-frame-options": "DENY",
            "x-content-type-options": "nosniff",
            "referrer-policy": "no-referrer",
            "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-28T03:02:14Z",
        "uuid": "b4cdac55-2a35-44e8-99e6-08bacf1c2c36",
        "scanned_at": "2026-10-28T02:31:32Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T03:31:48Z",
        "analysis_at": "2026-10-25T02:04:26Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 14,
            "suspicious": 2,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "Sophos": "phishing and fraud",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "registrar": "Gname.com Pte. Ltd.",
        "created": "2014-09-25T09:10:48Z",
        "expires": "2027-09-25T09:10:48Z",
        "updated": "2026-10-20T03:44:53Z",
        "first_seen": "2026-05-12T02:05:19Z",
        "dns": [
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "master.jmdns.com",
                "value": "ns1.julydns.com"
            },
            {
                "ttl": 1,
                "type": "A",
                "value": "168.76.254.108"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.julydns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.julydns.com"
            }
        ],
        "dns_at": "2026-10-25T02:04:44Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "gxruihang.com",
                "*.gxruihang.com"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "96eeeccbe5217150ea23ef8c16ce239",
            "sha256": "d5a5e1615a12791366c44e8cf5d01e32472d76d78a3aceacfc50521e5f9945e1",
            "subject": "gxruihang.com",
            "valid_to": "2026-12-18T19:04:08Z",
            "valid_from": "2026-09-19T18:05:36Z"
        },
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "registrar_iana_id": "1923",
            "registrar_url": "http://www.gname.com",
            "created": "2014-09-25T09:10:48Z",
            "updated": "2026-10-20T03:41:46Z",
            "expires": "2027-09-25T09:10:48Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.julydns.com",
                "ns2.julydns.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-25T09:10:48Z",
                "registration": "2014-09-25T09:10:48Z",
                "last update of RDAP database": "2026-10-17T08:24:40Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-28T02:33:08Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "gxruihang.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.27.251",
                    "host": "ns2.julydns.com"
                },
                {
                    "ip": "101.37.78.254",
                    "host": "ns1.julydns.com"
                }
            ],
            "zone": "gxruihang.com"
        },
        "dns": {
            "A": [
                "168.76.254.108"
            ],
            "NS": [
                "ns2.julydns.com",
                "ns1.julydns.com"
            ],
            "SOA": "{\"nsname\": \"ns1.julydns.com\", \"hostmaster\": \"master.jmdns.com\", \"serial\": 1792490572, \"refresh\": 3600, \"retry\": 1200, \"expire\": 86400, \"minttl\": 600}"
        }
    }
}
```