# PhishDestroy threat dossier — irontvpro-iptv.store ================================================================ Fetched: 2026-07-14 00:54:52 UTC Canonical: https://phishdestroy.io/domain/irontvpro-iptv.store/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 97/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/91 security vendors flagged this domain Flagging vendors: CRDF AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 194.145.209.26 (NL, Amsterdam) ASN: AS200514 KnownSRV Ltd. Hosting org: KnownSRV Ltd Registrar: NameCheap, Inc. Nameservers: ["ns1.knownsrv.com", "ns2.knownsrv.com"] Page title: Iron TV Pro | Site officiel, tarifs IPTV et installation HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-08-22 Status: INVALID chain Fingerprint: ad70b62a4a2c31d7b5d2fda8cfd2f2736670e92850d25a1fd6a19395d0ef2641 Subject Alternative Names (related infrastructure — often same operator): - irontvpro-iptv.store.irontvmax.shop - www.irontvpro-iptv.store.irontvmax.shop ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-12 17:36:00 UTC (by PhishDestroy tracker) Last verified: 2026-07-14 00:20:46 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f56f8-2a1f-767a-886d-9578f85044e3/ Wayback Machine: https://web.archive.org/web/*/irontvpro-iptv.store crt.sh CT logs: https://crt.sh/?q=%25.irontvpro-iptv.store Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=irontvpro-iptv.store AlienVault OTX: https://otx.alienvault.com/indicator/domain/irontvpro-iptv.store URLhaus: https://urlhaus.abuse.ch/host/irontvpro-iptv.store/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-12 18:40:40 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] The domain irontvpro-iptv.store is currently active and has been classified as a high‑risk generic phishing site. The public page title reads “Iron TV Pro | Site officiel, tarifs IPTV et installation”, indicating a possible focus on IPTV services, but the actual content has not been examined beyond the title. The site presents a valid TLS certificate issued by Let’s Encrypt (R13), and HTTP requests return a 200 status code. Infrastructure analysis shows the domain was registered through NameCheap, Inc. and resolves to the IPv4 address 194.145.209.26. Authoritative name servers are ns1.knownsrv.com and ns2.knownsrv.com. The web server identifies LiteSpeed and supports HTTP/3, suggesting a modern hosting environment that can deliver content efficiently. Threat intelligence sources provide limited but concrete signals. VirusTotal records a single positive detection out of 95 security vendors, indicating that at least one scanner has identified malicious behavior. AlienVault OTX references the domain in two separate threat pulses, reinforcing its association with phishing campaigns. No additional public reports or sandbox analyses are available. Given the confirmed active status, high risk rating, and the presence of a TLS certificate that can lend credibility to victims, defenders should consider proactive mitigation. Recommended actions include adding the domain to block lists, monitoring DNS queries for the IP address 194.145.209.26, and inspecting outbound traffic for any connections to the identified nameservers. Continuous observation of VirusTotal and OTX updates is advised to capture emerging indicators. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 9e3a2f53d53eba1d8cfa9b4902409b31 TLS cert SHA-256: ad70b62a4a2c31d7b5d2fda8cfd2f2736670e92850d25a1fd6a19395d0ef2641 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/irontvpro-iptv.store/ JSON API: https://api.destroy.tools/v1/check?domain=irontvpro-iptv.store Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 178,334 domains (50,013 alive under monitoring, 128,321 confirmed takedowns/dead). Site: https://phishdestroy.io