# mall666it.vip AliExpress-branded VIP task and recharge page | PhishDestroy

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mall666it.vip/
Machine-readable companion: https://phishdestroy.io/domain/mall666it.vip/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-31 22:20:49 UTC
- Last availability or vendor check: 2026-11-01 02:52:25 UTC
- Stored record updated: 2026-11-01 07:22:39 UTC
- VirusTotal detections in the stored snapshot: 3/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: checked_clean

## Stored labels and detections

- Automated brand label (collector metadata; not a confirmed impersonation finding): aliexpress

## Stored infrastructure

- Observed IP address: 148.66.18.243
- Registrar in stored WHOIS data: Gname.com Pte. Ltd.
- Registrar country in stored WHOIS data: SG
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-01 04:44:01 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a19435-fd70-7687-a1e7-a5781aa57892/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mall666it.vip
- Certificate Transparency search: https://crt.sh/?q=%25.mall666it.vip
- Web Archive lookup: https://web.archive.org/web/*/https://mall666it.vip/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Public report package

PhishDestroy describes mall666it.vip, a captured page branded AliExpress offering VIP task tiers, recharging, fast withdrawal and customer service in Turkish.

The captured page at mall666it.vip presents itself as AliExpress, with a large AliExpress banner and a Türkiye region selector at the top. Four action tiles offer "şimdi şarj et" (recharge now), "Hızlı para çekme" (fast withdrawal), "arkadaşları davet etmek" (invite friends) and "müşteri servisi" (customer service). Below them, two VIP panels labeled VIP1 and VIP2 each carry a "katıl" (join) button, and a bottom bar links to home, orders, recharging and login.

The stored VirusTotal domain result reports 3 detections out of 92 engines. CRDF reported "malicious"; Ermes reported "not recommended".
Package revision: b76d5c4a804c8871058166e055c2baba84621c575489516965736022e0d7e266
Text generated (not scan time): 2026-10-31 23:27:48
Reviewed evidence snapshot: {"domain":"mall666it.vip","screenshot_available":true,"initial_ai_description":"Insufficient page content for analysis","initial_ai_description_kind":"previous AI opinion, not independent evidence","virustotal":{"detections":3,"engines":92,"malicious":2,"suspicious":1,"retrieved_date":"2026-10-31","analysis_date":"2026-10-31","flagging_vendors":["CRDF","Ermes","LevelBlue"],"vendor_labels":{"CRDF":"malicious","Ermes":"not recommended","LevelBlue":"phishing"},"scope":"domain"},"capture_context":{"relationship":"screenshot associated with this domain record","captured_at":"2026-10-31T22:22:40Z","final_host":"mall666it.vip","captured_on":"2026-10-31"},"virustotal_public_summary":"The stored VirusTotal domain result reports 3 detections out of 92 engines. CRDF reported \"malicious\"; Ermes reported \"not recommended\".","page_paragraph_target_characters":512}
Source facts (timestamps as stored): {"record_id":1724199,"first_recorded_at":"2026-10-31 23:20:49","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":3,"denominator":92,"malicious":2,"suspicious":1,"vendors":{"CRDF":"malicious","Ermes":"not recommended","LevelBlue":"phishing"},"observed_at":"2026-10-31T03:02:27Z","checked_at":"2026-10-31 23:22:17","fetched_at":"2026-10-31T22:22:11Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":3,"denominator":92,"malicious":null,"suspicious":null,"vendors":["CRDF","Ermes","LevelBlue"],"observed_at":"2026-10-31 03:02:27","checked_at":"2026-10-31 23:22:17","fetched_at":"2026-10-31 22:22:17","time_basis":"as stored; legacy timezone not established"}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-10-31 23:22:25"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-11-01 00:30:27"},"availability":{"source":"stored HTTP observation","state":"alive","observed_at":"2026-11-01 03:52:25"}}

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a19435-fd70-7687-a1e7-a5781aa57892.png
  Captured: 2026-10-31 23:07:29 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a19303-c52d-776e-a039-e555682e1e6e.png
  Captured: 2026-10-31 22:20:49 UTC
  Source report: https://urlscan.io/result/01a19435-fd70-7687-a1e7-a5781aa57892/
- URLScan · 2026-10-31: https://screenshots.phishdestroy.io/us/01a1920f-035d-771d-84bd-d17c60bcb2eb.png
  Captured: 2026-10-31 13:03:52 UTC
  Source report: https://urlscan.io/result/01a1920f-035d-771d-84bd-d17c60bcb2eb/
  SHA-256: 2f6c893bb307ee52659d92620155d1062b58b092e34d596add0ac39ae850374e
- URLScan · 2026-10-31: https://screenshots.phishdestroy.io/us/01a192f6-ef26-7155-9415-4d52b458ec52.png
  Captured: 2026-10-31 17:17:14 UTC
  Source report: https://urlscan.io/result/01a192f6-ef26-7155-9415-4d52b458ec52/
  SHA-256: 84d6baf5402f477fd177899f8bd31c33a2987e0f7a52b38add15a0007269acb7
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/9a46c442-60cb-404e-aa68-026fab2f32bc.png
  Captured: 2026-10-31 22:22:40 UTC
  Source report: https://radar.cloudflare.com/scan/9a46c442-60cb-404e-aa68-026fab2f32bc
  SHA-256: 4a49a1fb70a51ccca9deeddb4f2d34bd66d219ea7060cf27dd05cfcc9cae58d4

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-31T23:07:53Z",
        "uuid": "01a19435-fd70-7687-a1e7-a5781aa57892",
        "scanned_at": "2026-10-31T23:05:40Z",
        "final_url": "https://mall666it.vip/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://mall666it.vip/",
                "from": "http://mall666it.vip/",
                "status": 307
            }
        ],
        "ip": "148.66.18.243",
        "domains": [
            "2026sp88.vip",
            "cdnjs.cloudflare.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "2a00:1450:4001:c15::5f",
            "104.17.25.14",
            "148.66.18.243"
        ],
        "asns": [
            "15169",
            "13335",
            "45753"
        ],
        "countries": [
            "DE",
            "HK"
        ],
        "doc_hash": "e8684d91a3cd04ad83c5b67c8903b39b8dc20a747ab3a9446d0f321e8d33f679",
        "script_hashes": [
            "264ef2e4767a942ee634794619d94edbd7da642cb79277c16b974cac9795c246",
            "a77361b1e7bc87f9002148fc701f0948375b6bc85a3af376748e205da7e22d9e",
            "c9634af5f9b16a9f44d78311163effd76467a2441f744859c96fc066a3b58aa8",
            "39eed2d24faf4985b922b64d078f106edba6b3b84d5385e483a5c7bd69201da7",
            "ea9c81db3bf4e708fccee76f211080e15889d6a7efb7134d71e6d728fc0ec5b1",
            "312b79e4090cfc77859e6744f7753603db72e28ab44a38c60424d2afe26348a3"
        ],
        "globals": [
            "lib",
            "rem",
            "dpr",
            "$",
            "jQuery",
            "__core-js_shared__",
            "core",
            "global",
            "System",
            "asap",
            "setImmediate",
            "clearImmediate",
            "Dict",
            "delay",
            "_",
            "Vue",
            "axios",
            "Vuex",
            "t",
            "e",
            "VueI18n",
            "VueRouter",
            "ELEMENT",
            "Swiper",
            "Cookies",
            "vant",
            "SockJS",
            "webpackJsonp",
            "regeneratorRuntime",
            "progress",
            "openedActions",
            "isOpened",
            "sliderRequestAnimationFrame",
            "sliderDirection",
            "buttonsRight",
            "buttonsLeft",
            "sliderActionRight",
            "sliderActionLeft",
            "sliderActionRightWidth",
            "sliderActionLeftWidth"
        ],
        "storage_keys": [
            "SITE_TEMPLATE",
            "langCode",
            "lang",
            "app_home_uri",
            "app_stored_uri",
            "app_stored_timestamp"
        ],
        "tls": {
            "san": [
                "mall666it.vip"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YE2",
            "subject": "mall666it.vip",
            "protocol": "TLS 1.2",
            "valid_to": "2027-01-29T10:26:59Z",
            "valid_from": "2026-10-31T10:27:00Z"
        },
        "domain_age_days": 60,
        "apex_age_days": 60,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 194,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "fakeshop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Fake Shop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx/1.22.1",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-31T22:26:54Z",
        "uuid": "9a46c442-60cb-404e-aa68-026fab2f32bc",
        "scanned_at": "2026-10-31T22:22:40Z",
        "final_url": "https://mall666it.vip/",
        "status": 200,
        "history": [
            {
                "url": "https://mall666it.vip/",
                "status": 200
            }
        ],
        "dom_hash": "d2bf3aef2697100e396c471ecc1a8fa6d0ec8982878cdb589b209294ec6f03be",
        "doc_hash": "e8684d91a3cd04ad83c5b67c8903b39b8dc20a747ab3a9446d0f321e8d33f679",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mall666it.vip",
                "type": "A",
                "value": "148.66.18.243"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.18",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "created": "2026-09-01T06:44:01Z",
            "updated": "2026-10-31T06:44:01Z",
            "expires": "2027-09-01T06:44:01Z",
            "nameservers": [
                "b7.share-dns.net",
                "a7.share-dns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-31T22:22:11Z",
        "analysis_at": "2026-10-31T03:02:27Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 2,
            "suspicious": 1,
            "undetected": 38
        },
        "detections": {
            "CRDF": "malicious",
            "Ermes": "not recommended",
            "LevelBlue": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "Google": "shopping",
            "Sophos": "phishing and fraud",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "registrar": "Gname.com Pte. Ltd.",
        "created": "2026-09-01T06:44:01Z",
        "expires": "2027-09-01T06:44:01Z",
        "updated": "2026-09-06T06:44:05Z",
        "first_seen": "2026-09-01T11:20:39Z",
        "dns": [
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "master.share-dns.com",
                "value": "a.share-dns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "a.share-dns.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "148.66.18.243"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "b.share-dns.net"
            }
        ],
        "dns_at": "2026-10-31T03:08:26Z",
        "jarm": "28d28d28d00028d00028d28d28d28dd5ccd273978ad18a14ab751b52670c0b",
        "cert": {
            "san": [
                "mall666it.vip"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6b3b4ac1b490c097bb971339f7c88f2128f",
            "sha256": "58085109b06c152a27ae202eb76a200930de0507582284a63cbb753984a421c7",
            "subject": "mall666it.vip",
            "valid_to": "2026-11-30T09:41:19Z",
            "valid_from": "2026-09-01T09:41:20Z"
        },
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "registrar_iana_id": "1923",
            "registrar_url": "https://www.gname.com/",
            "created": "2026-09-01T06:44:01Z",
            "updated": "2026-09-06T06:44:05Z",
            "expires": "2027-09-01T06:44:01Z",
            "status": [
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "a7.share-dns.com",
                "b7.share-dns.net"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "server transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-01T06:44:01Z",
                "registration": "2026-09-01T06:44:01Z",
                "last update of RDAP database": "2026-10-27T06:44:18Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-31T22:27:16Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "mall666it.vip"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-31T22:21:34Z",
            "first": "2026-10-31T22:21:34Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 3581
        },
        "trackers": {
            "requests": 186,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 13
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://cdnjs.cloudflare.com/ajax/libs/core-js/2.6.9/core.min.js",
                "https://cdnjs.cloudflare.com/ajax/libs/vue/2.6.10/vue.min.js",
                "https://cdnjs.cloudflare.com/ajax/libs/axios/0.19.0-beta.1/axios.min.js",
                "https://cdnjs.cloudflare.com/ajax/libs/vuex/3.1.1/vuex.min.js",
                "https://cdnjs.cloudflare.com/ajax/libs/vue-i18n/8.12.0/vue-i18n.min.js",
                "https://cdnjs.cloudflare.com/ajax/libs/vue-router/3.0.7/vue-router.min.js",
                "https://cdnjs.cloudflare.com/ajax/libs/element-ui/2.15.4/index.js",
                "https://cdnjs.cloudflare.com/ajax/libs//Swiper/4.5.1/js/swiper.min.js",
                "https://cdnjs.cloudflare.com/ajax/libs/js-cookie/2.2.1/js.cookie.js",
                "https://cdnjs.cloudflare.com/ajax/libs/vant/2.13.2/vant.min.js"
            ],
            "third_party_scripts": 11
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 516,
                "tls": 332,
                "wait": 166,
                "connect": 160,
                "download": 0
            },
            "response_ms": 1174
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "ECDHE-ECDSA-AES256-GCM-SHA384",
            "protocol": "TLSv1.2",
            "versions": [
                "TLSv1.2"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 13531,
            "co2_grams": 0.0005,
            "cleaner_than": 65
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.27.88",
                    "host": "b.share-dns.net"
                },
                {
                    "ip": "172.64.53.25",
                    "host": "a.share-dns.com"
                }
            ],
            "zone": "mall666it.vip"
        },
        "location": {
            "ip": "148.66.18.243",
            "asn": "45753",
            "org": "Netsec Limited",
            "city": "Hong Kong",
            "country": "HK"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "mall666it.vip"
        },
        "dns": {
            "A": [
                "148.66.18.243"
            ],
            "NS": [
                "a.share-dns.com",
                "b.share-dns.net"
            ],
            "SOA": "{\"nsname\": \"a.share-dns.com\", \"hostmaster\": \"master.share-dns.com\", \"serial\": 1788245064, \"refresh\": 3600, \"retry\": 1200, \"expire\": 86400, \"minttl\": 600}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "148.66.18.243",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://mall666it.vip"
            ]
        },
        "subdomains": {
            "count": 1,
            "subdomains": [
                "www.mall666it.vip"
            ]
        },
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "created": "2026-09-01T06:44:01Z",
            "updated": "2026-10-31T06:44:01Z",
            "expires": "2027-09-01T06:44:01Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "a7.share-dns.com",
                "b7.share-dns.net"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx/1.22.1",
                "content-type": "text/html"
            }
        }
    }
}
```