# PhishDestroy domain threat record: kolkata-fix-frant.surge.sh Content language: English Canonical HTML report: https://phishdestroy.io/domain/kolkata-fix-frant.surge.sh/ Machine-readable companion: https://phishdestroy.io/domain/kolkata-fix-frant.surge.sh/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-08-31 07:34:44 UTC - Last availability or vendor check: 2026-10-21 01:37:38 UTC - Stored record updated: 2026-10-22 14:22:50 UTC - VirusTotal detections in the stored snapshot: 11/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: ScamSniffer - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Trust Wallet ## Stored infrastructure - Observed IP address: 159.203.50.177 - Registrar in stored WHOIS data: Surge.sh - Last stored HTTP status: 451 - Registration date (registry RDAP, surge.sh): 2014-07-25 23:10:53 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a056bc-9419-77b6-9ce4-c8fe08ab8181/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/kolkata-fix-frant.surge.sh - Certificate Transparency search: https://crt.sh/?q=%25.kolkata-fix-frant.surge.sh - Web Archive lookup: https://web.archive.org/web/*/https://kolkata-fix-frant.surge.sh/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview kolkata-fix-frant.surge.sh is a phishing page that impersonates Trust Wallet under the title "Transfer Trust Wallet". It targets people who hold crypto in Trust Wallet and can be talked into a supposed transfer or migration of their wallet. PhishDestroy first flagged it on 2026-08-31. As of 2026-10-19 the site was still online and serving its phishing content. How the scam works The title "Transfer Trust Wallet" frames the visit as a routine procedure, such as moving funds or migrating a wallet, so the request that follows looks legitimate. Pages of this kind usually ask the victim to type in their 12- or 24-word recovery phrase or private key to complete the transfer, or to connect their wallet and approve a prompt. Whoever holds a recovery phrase controls the wallet, so the operators can empty it from their own device, often within minutes. Trust Wallet never asks users to submit their recovery phrase on any website. Evidence On 2026-10-15, VirusTotal showed 11 of 92 engines flagging the site, including Kaspersky, Fortinet, Forcepoint ThreatSeeker, alphaMountain.ai, Ermes, Gridinsoft, LevelBlue and Lionic. That is a minority of engines, but the detections come from independent vendors with separate detection pipelines. ScamSniffer, a blocklist that focuses on crypto threats, also lists the domain alongside PhishDestroy. Infrastructure The page sits on a subdomain of Surge.sh, a free static-site publishing service. Platforms like this let anyone publish a page in seconds without registering their own domain, and the throwaway-looking name fits that pattern. The site resolves to DigitalOcean, LLC infrastructure in Canada. It uses a domain-validated Sectigo certificate, so the browser padlock only shows that the connection is encrypted and says nothing about who runs the page. What to do If you entered your recovery phrase or private key on this page, treat the wallet as compromised. Create a new wallet with a new phrase on a trusted device and move any remaining funds there immediately. If you connected a wallet or signed a prompt, revoke token approvals with a reputable approval-checking tool and watch the address for unexpected transfers. Do not respond to anyone offering paid recovery help, as these offers are a common follow-up scam. Defenders should block the full hostname at the DNS and proxy level and report it to Surge.sh and DigitalOcean for takedown. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a056bc-9419-77b6-9ce4-c8fe08ab8181/ VirusTotal report: https://www.virustotal.com/gui/domain/kolkata-fix-frant.surge.sh Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=kolkata-fix-frant.surge.sh Archived copy: https://web.archive.org/web/20260831073722/https://kolkata-fix-frant.surge.sh/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:53:50 UTC ## Stored page captures - Primary capture: https://i.ibb.co/bMFmt77m/d42da9921821.png Captured: 2026-08-31 07:34:44 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a056bc-9419-77b6-9ce4-c8fe08ab8181.png Captured: 2026-08-31 07:34:44 UTC Source report: https://urlscan.io/result/01a056bc-9419-77b6-9ce4-c8fe08ab8181/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:26:50Z", "uuid": "01a056bc-9419-77b6-9ce4-c8fe08ab8181", "scanned_at": "2026-08-31T07:33:21Z", "final_url": "https://kolkata-fix-frant.surge.sh/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://kolkata-fix-frant.surge.sh/", "from": "http://kolkata-fix-frant.surge.sh/", "status": 307 } ], "ip": "138.197.235.123", "domains": [ "cdn.jsdelivr.net" ], "ips": [ "2a04:4e42::485", "138.197.235.123" ], "asns": [ "54113", "14061" ], "countries": [ "US" ], "doc_hash": "de2af03238f53755d07b393a099bbc3c419072dcda0dde3f1c51cdb5cba87273", "script_hashes": [ "3028a928e2e7c8e21de31080579b80ca954ec4f1a1dde572cf80f7def347c60e", "6215c9ab3fa56976ac6412c700335d24de100298872c6f238fa6767a8beb0462" ], "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart", "_ethers", "ethers", "CONFIG" ], "tls": { "san": [ "*.surge.sh", "surge.sh" ], "cipher": "AES_256_GCM", "issuer": "Sectigo Public Server Authentication CA DV R36", "subject": "*.surge.sh", "protocol": "TLS 1.3", "valid_to": "2026-12-16T23:59:59Z", "valid_from": "2026-06-01T00:00:00Z" }, "domain_age_days": 1, "apex_age_days": 4210, "tls_age_days": 91, "tls_valid_days": 198, "requests": 6, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 57, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Surge", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:37:43Z", "uuid": "14313a91-7cc7-47b0-9a49-12dd4c4cac7e", "scanned_at": "2026-08-31T07:51:01Z", "final_url": "https://kolkata-fix-frant.surge.sh/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://kolkata-fix-frant.surge.sh/", "status": 307 }, { "url": "https://kolkata-fix-frant.surge.sh/", "status": 200 } ], "dom_hash": "8196279ef06d2b51c0b2db97fbd46a9965ef27986d80539f26b8533939e2ce5d", "doc_hash": "de2af03238f53755d07b393a099bbc3c419072dcda0dde3f1c51cdb5cba87273", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "kolkata-fix-frant.surge.sh", "type": "A", "value": "188.166.132.94" } ], "dnssec_valid": false, "ip": "188.166.132.94", "whois": { "registrar": "Porkbun LLC", "created": "2014-07-25T23:10:53Z", "updated": "2026-08-11T20:27:40Z", "expires": "2027-07-25T23:10:53Z", "nameservers": [ "ns1.surge.world", "ns2.surge.world", "ns3.surge.world", "ns4.surge.world" ] } } } ```