# PhishDestroy threat dossier — js12130.vip ================================================================ Fetched: 2026-07-23 10:41:24 UTC Canonical: https://phishdestroy.io/domain/js12130.vip/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 46/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/91 security vendors flagged this domain Flagging vendors: Bfore.Ai PreCrime Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.65.235.97 (US, San Francisco) ASN: ASAS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US Hosting org: AS13335 Cloudflare, Inc. Registrar: Gname.com Pte. Ltd. Nameservers: a.share-dns.com, a11.share-dns.com, b.share-dns.net, b11.share-dns.net Registered: 2026-03-15 Expires: 2027-03-15 HTTP response: 503 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-03-15 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-21 02:25:05 UTC (by PhishDestroy tracker) First reported: 2026-07-21 00:30:24 UTC (abuse notice filed) Last verified: 2026-07-23 12:20:25 UTC Neutralised: 2026-07-21 04:19:47 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f820e-d31a-71b8-b751-3e0950b414ef/ URLQuery: https://urlquery.net/report/8fcfc275-e4af-4ff8-8d33-bbc1741a0c56 Wayback Machine: https://web.archive.org/web/*/js12130.vip crt.sh CT logs: https://crt.sh/?q=%25.js12130.vip Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=js12130.vip AlienVault OTX: https://otx.alienvault.com/indicator/domain/js12130.vip URLhaus: https://urlhaus.abuse.ch/host/js12130.vip/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-21 02:25:24 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] js12130.vip Phishing Site Alert The domain js12130.vip was registered on 15 March 2026 through Gname.com Pte. Ltd. and is currently hosted on the IP address 172.65.235.97. The authoritative name servers for the zone are a.share-dns.com, a11.share-dns.com, b.share-dns.net, and b11.share-dns.net, indicating use of a shared DNS service. VirusTotal reports that one out of ninety‑five scanning engines has flagged the domain, suggesting at least minimal detection by security vendors. The domain is listed on a single public blocklist and has been actively blocked by the PhishDestroy mitigation platform, confirming that it is being treated as malicious by at least one commercial anti‑phishing service. The domain remains active as of the report date, 21 July 2026, and no evidence of takedown or sink‑hole operation has been observed. Analysis of the available data does not reveal a specific brand or service that the site is attempting to impersonate; the page title and content have not been publicly disclosed. Consequently, the exact phishing campaign vector, credential‑stealing technique, or targeted user demographic cannot be confirmed at this time. The limited detection footprint—only one vendor flag and a single blocklist entry—may indicate a low‑profile operation or recent deployment that has not yet been widely shared among threat‑intel feeds. Defenders should add the IP address 172.65.235.97 and the domain js12130.vip to URL filtering and DNS sinkhole policies. Monitoring of the shared DNS nameservers for additional domains that resolve to the same IP can help uncover related infrastructure. Organizations using web‑proxy or secure web‑gateway solutions should ensure that traffic to this domain is blocked, and incident response teams should remain alert for any credential‑theft attempts that reference the domain. Continuous re‑evaluation of VirusTotal and other multi‑engine scanners is recommended, as additional detections may emerge as the campaign matures. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260721-1CFCB2 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/js12130.vip/ JSON API: https://api.destroy.tools/v1/check?domain=js12130.vip Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 188,691 domains (58,653 alive under monitoring, 128,416 confirmed takedowns/dead). Site: https://phishdestroy.io