# PhishDestroy domain threat record: mamod-ex.asia

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mamod-ex.asia/
Machine-readable companion: https://phishdestroy.io/domain/mamod-ex.asia/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 16:17:35 UTC
- Last availability or vendor check: 2026-10-28 11:03:48 UTC
- Stored record updated: 2026-10-28 11:23:46 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: GNAME.COM PTE. LTD.
- Registrar country in stored WHOIS data: HK
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-23 03:47:27 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1790e-b3c4-73a9-a419-c35ce0f2b6e1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mamod-ex.asia
- Certificate Transparency search: https://crt.sh/?q=%25.mamod-ex.asia
- Web Archive lookup: https://web.archive.org/web/*/https://mamod-ex.asia/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot from 2026-10-26 shows a MaMo-Dex trading dashboard with BTC/USD, ETH/USD and BNB/USD tickers, Deposit, Withdrawal, Flash, Transfer, Mining and Customer Service shortcuts, a gains table of pairs, and bottom navigation for Home, Market, Trade, Perpetual and Assets. A banner urged visitors to start their digital currency journey for exceptional profits. PhishDestroy listed the domain as a fake crypto exchange, first seen on 2026-10-26 after an admin report and automated assessment, three days after its 2026-10-23 registration.

How the scam works
The page enables a fake-exchange category risk by combining live-looking prices, deposit and withdrawal controls, and profit language that encourages visitors to fund an account or connect a wallet on an unverified platform. Referral wording inviting users to share with friends widens the funnel, while account and deposit flows on a three-day-old exchange copy are the typical point where funds or credentials are lost.

Evidence
The screenshot shows the profit lure, market tables and deposit and withdrawal controls. urlscan engine verdicts scored the page malicious at 99 on 2026-10-26 while its overall verdict stayed not malicious, and an earlier scan funnelled the request to HTTPS with status 307. VirusTotal did not flag the domain; Google Safe Browsing did not flag it either, and Spamhaus DBL did not list it. PhishDestroy blocklists include MetaMask and SEAL plus an internal entry, and OTX recorded 3 pulses. Site inspection recorded a Vue and Vite front end with TradingView globals, 60 tracker requests, and 10 distinct script SHA256 hashes for campaign pivoting, the first beginning cb0c6c9f1771.

Infrastructure
Notable weaknesses: no Content-Security-Policy, HSTS strict-transport, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy or COOP/COEP/CORP headers; no SPF, DKIM or DMARC email authentication; DNSSEC unsigned. A CAA record is present. The domain was registered on 2026-10-23 through GNAME.COM PTE. LTD., and as observed on 2026-10-26 it was served through Cloudflare with its WAF; TLS 1.3 with forward secrecy and ALPN h2, cipher TLS_AES_256_GCM_SHA384.

What to do
If you submitted credentials or deposited funds, change your password on any genuine exchange account you used, enable 2FA, and review and revoke any wallet connections or token approvals you made on mamod-ex.asia. Defenders should block mamod-ex.asia and pivot on the recorded script hashes.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1790e-b3c4-73a9-a419-c35ce0f2b6e1/
Cloudflare Radar report: https://radar.cloudflare.com/scan/f4d050f2-d070-4b96-a149-5a941d318850
URLQuery report: https://urlquery.net/report/ed39917c-1359-48d3-9cad-796d733e93ec
Stored capture screenshot: https://i.ibb.co/VWfqwtKZ/50d438a32677.png
Cloudflare Radar screenshot (2026-10-26T16:31:35Z): https://screenshots.phishdestroy.io/cf/f4d050f2-d070-4b96-a149-5a941d318850.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/ed39917c-1359-48d3-9cad-796d733e93ec.png
URLScan screenshot (2026-10-26T08:50:41Z): https://screenshots.phishdestroy.io/us/01a17767-7bcd-701b-868f-e2a42b3872fe.png
URLScan capture report: https://urlscan.io/result/01a17767-7bcd-701b-868f-e2a42b3872fe/
URLScan screenshot (2026-10-26T16:37:21Z): https://screenshots.phishdestroy.io/us/01a17912-8311-765e-bec2-67d2a57a3057.png
URLScan capture report: https://urlscan.io/result/01a17912-8311-765e-bec2-67d2a57a3057/
VirusTotal report: https://www.virustotal.com/gui/domain/mamod-ex.asia
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mamod-ex.asia
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:13:02 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/VWfqwtKZ/50d438a32677.png
  Captured: 2026-10-26 16:33:58 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a1790e-b3c4-73a9-a419-c35ce0f2b6e1.png
  Captured: 2026-10-26 16:33:58 UTC
  Source report: https://urlscan.io/result/01a1790e-b3c4-73a9-a419-c35ce0f2b6e1/
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17767-7bcd-701b-868f-e2a42b3872fe.png
  Captured: 2026-10-26 08:50:41 UTC
  Source report: https://urlscan.io/result/01a17767-7bcd-701b-868f-e2a42b3872fe/
  SHA-256: 1ede1d295b754f439bdd3b3413d751dbdfd6f8a718ac8530491d617b13a46133
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17912-8311-765e-bec2-67d2a57a3057.png
  Captured: 2026-10-26 16:37:21 UTC
  Source report: https://urlscan.io/result/01a17912-8311-765e-bec2-67d2a57a3057/
  SHA-256: e9f05f60c3d7ca4ccedf032fb9226a50b4291ee4b0d76e0ba8447991eda1bb9a
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f4d050f2-d070-4b96-a149-5a941d318850.png
  Captured: 2026-10-26 16:31:35 UTC
  Source report: https://radar.cloudflare.com/scan/f4d050f2-d070-4b96-a149-5a941d318850
  SHA-256: b1e5e93a8174d19347ee13e4e78a464d65840e18c65bc5e53ea2d898e8f1281c
- URLQuery: https://screenshots.phishdestroy.io/uq/ed39917c-1359-48d3-9cad-796d733e93ec.png
  Source report: https://urlquery.net/report/ed39917c-1359-48d3-9cad-796d733e93ec
  SHA-256: 9561c86bd4fd5cbaf78125f506b89ef954d91e605b7122e1ed70fc28daddf542

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T16:40:21Z",
        "uuid": "01a1790e-b3c4-73a9-a419-c35ce0f2b6e1",
        "scanned_at": "2026-10-26T16:32:56Z",
        "final_url": "https://mamod-ex.asia/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://mamod-ex.asia/",
                "from": "http://mamod-ex.asia/",
                "status": 307
            }
        ],
        "ip": "188.114.96.3",
        "domains": [
            "h2703.oss-cn-hongkong.aliyuncs.com"
        ],
        "ips": [
            "47.79.65.170",
            "188.114.96.3"
        ],
        "asns": [
            "45102",
            "13335"
        ],
        "countries": [
            "HK"
        ],
        "doc_hash": "8203f3ce14332570c42519151c910bbcb9116c3e7c8b21089d8028f181c61706",
        "script_hashes": [
            "cb0c6c9f1771d252eee7caa043bdd7cfffbd52c2cc4b18b7be7c4554ed069151",
            "ff06738377eee46f4392471c96098fc2cdec7c3b1f7ed47ffbd2c2c7e1db02e4",
            "e14a649900c07a911ef0c8372fe6a876453711c2218ce6c1430b00a26bb7c980",
            "3a4b3fd9cb529cdcab20bd7f933441f494d59948533e02791c113384843ebfa5",
            "ac042e6cae0222f9bf7ba932ac1065a3bc8c7e62cfc50f3767a5929bcdb5425c",
            "e8cbc6e0a36a4ab7ac206b2068bcb50a0cb9ecb6a9f2043ec0a0ff938e53bc7f",
            "3fe0385ab9d6071252cc46da4c9028fd2fa7123e811ace3c425d001a3776617b",
            "62c63adef93e192f0a0664efdf175c361b57e7a9d67e41939f1d141f7e486e24",
            "8ab77041570645580bfcaf5ffe292828a2a9cd0a35fa2f891d1059cc7d9ee062",
            "71fc1c0002dc5edaed4549ec159620617858768699caf8064c9a13df76ef8e60"
        ],
        "globals": [
            "TradingView",
            "addLink",
            "addMeta",
            "lib",
            "rem",
            "dpr",
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_SSR_SETTERS__",
            "__INTLIFY_PROD_DEVTOOLS__",
            "__INTLIFY_JIT_COMPILATION__",
            "__INTLIFY_DROP_MESSAGE_COMPILER__",
            "__VUE_I18N_FULL_INSTALL__",
            "__VUE_I18N_LEGACY_API__",
            "setImmediate",
            "clearImmediate",
            "PubSub",
            "__config",
            "__theme",
            "__VUE__",
            "__vite_is_modern_browser"
        ],
        "storage_keys": [
            "alading_THEME",
            "fromPath",
            "main",
            "alading_LANGUAGE"
        ],
        "tls": {
            "san": [
                "*.mamod-ex.asia",
                "mamod-ex.asia"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "mamod-ex.asia",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-21T04:57:45Z",
            "valid_from": "2026-10-23T04:57:46Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 3,
        "tls_valid_days": 89,
        "requests": 62,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T16:33:20Z",
        "uuid": "f4d050f2-d070-4b96-a149-5a941d318850",
        "scanned_at": "2026-10-26T16:31:35Z",
        "final_url": "https://mamod-ex.asia/",
        "status": 200,
        "history": [
            {
                "url": "https://mamod-ex.asia/",
                "status": 200
            }
        ],
        "dom_hash": "0cd8686fad718e72631d6f173317c92cf6e68468cde600da52aa3494e5a2adcc",
        "doc_hash": "393d338e1c9caf381e1abed60df39644d523e77d9933d6f6f2c03cd650e6a878",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mamod-ex.asia",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "mamod-ex.asia",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "mamod-ex.asia",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            },
            {
                "name": "mamod-ex.asia",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.97.0",
        "whois": {
            "registrar": "GNAME.COM PTE. LTD.",
            "created": "2026-10-23T05:47:27Z",
            "updated": "2026-10-23T05:51:05Z",
            "expires": "2027-10-23T05:47:27Z",
            "nameservers": [
                "jerome.ns.cloudflare.com",
                "maleah.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T17:01:27Z",
        "analysis_at": "2026-10-24T07:06:24Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 39
        },
        "reputation": 0,
        "registrar": "GNAME.COM PTE. LTD.",
        "created": "2026-10-23T05:47:27Z",
        "expires": "2027-10-23T05:47:27Z",
        "updated": "2026-10-23T05:51:05Z",
        "first_seen": "2026-10-23T07:17:31Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:89ec"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.38.191"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.137.236"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "jerome.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "maleah.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "jerome.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:26bf"
            }
        ],
        "dns_at": "2026-10-24T07:07:59Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.mamod-ex.asia",
                "mamod-ex.asia"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5de2cef5dbdad08b98748647d8b1d9c679",
            "sha256": "a16a9051cb904d09ee70095cf91ed4f1aff9cbc07ada5c35928ffcdaacf5cd71",
            "subject": "mamod-ex.asia",
            "valid_to": "2027-01-21T04:57:45Z",
            "valid_from": "2026-10-23T04:57:46Z"
        },
        "whois": {
            "registrar": "GNAME.COM PTE. LTD.",
            "registrar_iana_id": "1923",
            "registrar_url": "www.gname.com",
            "created": "2026-10-23T05:47:27Z",
            "updated": "2026-10-23T05:51:05Z",
            "expires": "2027-10-23T05:47:27Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "jerome.ns.cloudflare.com",
                "maleah.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-23T05:47:27Z",
                "registration": "2026-10-23T05:47:27Z",
                "last update of RDAP database": "2026-10-23T05:51:05Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:40:43Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "mamod-ex.asia"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T16:23:47Z",
            "first": "2026-10-26T16:23:47Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 3495
        },
        "social_tags": {
            "ogUrl": "https://mamodex.top/",
            "title": "MaMo-DexMaMo-Dex: Your trusted trading platform",
            "ogType": "website",
            "robots": "all",
            "ogImage": "https://mamodex.top/logo.png",
            "ogTitle": "FxPro US: Your trusted trading platform",
            "keywords": "MaMo-Dex",
            "ogSiteName": "MaMo-Dex",
            "themeColor": "#ffffff",
            "description": "MaMo-Dex",
            "twitterCard": "summary_large_image",
            "ogDescription": "MaMo-Dex"
        },
        "trackers": {
            "requests": 60
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 22,
                "wait": 82,
                "connect": 6,
                "download": 0
            },
            "response_ms": 112
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 6385,
            "co2_grams": 0.0002,
            "cleaner_than": 81
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.193.181",
                    "host": "jerome.ns.cloudflare.com"
                },
                {
                    "ip": "162.159.38.118",
                    "host": "maleah.ns.cloudflare.com"
                }
            ],
            "zone": "mamod-ex.asia"
        },
        "location": {
            "ip": "2a06:98c1:3121::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "mamod-ex.asia"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "maleah.ns.cloudflare.com",
                "jerome.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"jerome.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418240716, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://mamod-ex.asia"
            ]
        },
        "whois": {
            "registrar": "GNAME.COM PTE. LTD.",
            "created": "2026-10-23T05:47:27Z",
            "updated": "2026-10-23T05:51:05Z",
            "expires": "2027-10-23T05:47:27Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "jerome.ns.cloudflare.com",
                "maleah.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```