# PhishDestroy domain threat record: mmdancr.sbs

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mmdancr.sbs/
Machine-readable companion: https://phishdestroy.io/domain/mmdancr.sbs/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 16:16:29 UTC
- Last availability or vendor check: 2026-10-26 16:16:29 UTC
- Stored record updated: 2026-10-26 20:14:24 UTC
- VirusTotal detections in the stored snapshot: 5/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: OpenPhish
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 43.173.22.50
- Registrar in stored WHOIS data: NameMart Pte. Ltd.
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a178fe-658b-717d-ace3-b90666b5ce61/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mmdancr.sbs
- Certificate Transparency search: https://crt.sh/?q=%25.mmdancr.sbs
- Web Archive lookup: https://web.archive.org/web/*/https://mmdancr.sbs/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot from 2026-10-26 shows a plain grey page holding one checkbox labelled Verify you are human beside Cloudflare branding with Privacy and Help links. PhishDestroy listed mmdancr.sbs after VirusTotal flagged it as malicious, and PhishDestroy first observed the domain on 2026-10-26, one day after its 2026-10-25 registration.

How the scam works
The page imitates a familiar human-verification prompt so a visitor lowers their guard and clicks without checking the address bar. As a category risk, spoofed verification screens act as a low-friction entry point that can forward people toward credential capture or further lure pages.

Evidence
The screenshot shows only the fake verification checkbox and Cloudflare branding, with no other offer or form visible. On 2026-10-26 urlscan's engine marked the page malicious with an ML score of 96 while its overall verdict stayed clean, Google Safe Browsing did not flag it, and Spamhaus listed it as not listed. VirusTotal flagged mmdancr.sbs as malicious, with phishing labels from SOCRadar, LevelBlue and alphaMountain.ai, malicious labels from CRDF and Webroot, and Sophos categorising it as phishing and fraud; OTX recorded 3 pulses and blocklists show OpenPhish plus PhishDestroy's internal list on 2026-10-26. A 307 redirect moved the HTTP version to the HTTPS version, one tracker request was recorded, and one HTTP response code 200 was captured on 2026-10-26.

Infrastructure
Recorded registration is with NameMart Pte. Ltd. created 2026-10-25, and the recorded hosting network is Tencent with a single A record. Notable weaknesses come first: no Content-Security-Policy, no HSTS, no Permissions-Policy and no COOP, COEP or CORP, while X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff and Referrer-Policy strict-origin-when-cross-origin are present. TLS 1.3, AES-128-GCM, forward secrecy, ALPN h2. No SPF lookups and no DKIM or DMARC records; a CAA record is present; DNSSEC is unsigned.

What to do
A visitor who entered credentials or personal data through mmdancr.sbs should change that password on the genuine service, enable two-factor authentication, and review recent account activity and unfamiliar messages. Defenders should block mmdancr.sbs, hunt for the domain across logs and mail gateways, and keep detections tied to the observed capture of 2026-10-26.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a178fe-658b-717d-ace3-b90666b5ce61/
Cloudflare Radar report: https://radar.cloudflare.com/scan/a098f8b8-396a-4ffc-8cfb-0682dc0e70b1
URLQuery report: https://urlquery.net/report/d5ba1dc9-0831-49a3-9fb2-6ab4efe008f7
Stored capture screenshot: https://i.ibb.co/7BbJT9j/ed5eae5a42c5.png
Cloudflare Radar screenshot (2026-10-26T16:48:27Z): https://screenshots.phishdestroy.io/cf/a098f8b8-396a-4ffc-8cfb-0682dc0e70b1.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/d5ba1dc9-0831-49a3-9fb2-6ab4efe008f7.png
URLScan screenshot (2026-10-26T05:55:13Z): https://screenshots.phishdestroy.io/us/01a176c5-78ff-7479-b36d-949096f0fb27.png
URLScan capture report: https://urlscan.io/result/01a176c5-78ff-7479-b36d-949096f0fb27/
URLScan screenshot (2026-10-26T06:11:45Z): https://screenshots.phishdestroy.io/us/01a176d5-ea8e-730b-b3b5-e9f13f450946.png
URLScan capture report: https://urlscan.io/result/01a176d5-ea8e-730b-b3b5-e9f13f450946/
URLScan screenshot (2026-10-26T13:00:21Z): https://screenshots.phishdestroy.io/us/01a1784c-023e-778c-816f-e2e5e955ee82.png
URLScan capture report: https://urlscan.io/result/01a1784c-023e-778c-816f-e2e5e955ee82/
URLScan screenshot (2026-10-26T16:21:32Z): https://screenshots.phishdestroy.io/us/01a17904-4153-73db-b278-07e29027efee.png
URLScan capture report: https://urlscan.io/result/01a17904-4153-73db-b278-07e29027efee/
URLScan screenshot (2026-10-26T16:30:56Z): https://screenshots.phishdestroy.io/us/01a1790c-9d64-70ef-9f6e-515faf550ff2.png
URLScan capture report: https://urlscan.io/result/01a1790c-9d64-70ef-9f6e-515faf550ff2/
VirusTotal report: https://www.virustotal.com/gui/domain/mmdancr.sbs
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mmdancr.sbs
Archived copy: https://web.archive.org/web/20261026161610/https://mmdancr.sbs/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:14:24 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/7BbJT9j/ed5eae5a42c5.png
  Captured: 2026-10-26 16:16:29 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a178fe-658b-717d-ace3-b90666b5ce61.png
  Captured: 2026-10-26 16:16:29 UTC
  Source report: https://urlscan.io/result/01a178fe-658b-717d-ace3-b90666b5ce61/
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1784c-023e-778c-816f-e2e5e955ee82.png
  Captured: 2026-10-26 13:00:21 UTC
  Source report: https://urlscan.io/result/01a1784c-023e-778c-816f-e2e5e955ee82/
  SHA-256: 92b46eb9479522e60a0052072983b47c024b7e0f60a9a2851050f3b6c8595a02
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a176c5-78ff-7479-b36d-949096f0fb27.png
  Captured: 2026-10-26 05:55:13 UTC
  Source report: https://urlscan.io/result/01a176c5-78ff-7479-b36d-949096f0fb27/
  SHA-256: 667fe3aa65fff0683c09c74caf47d5ccf68edcb2f813f6e3d52d6c959a0eaa39
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a176d5-ea8e-730b-b3b5-e9f13f450946.png
  Captured: 2026-10-26 06:11:45 UTC
  Source report: https://urlscan.io/result/01a176d5-ea8e-730b-b3b5-e9f13f450946/
  SHA-256: cfcfa230777668c79716bca07f13794df3c8c1143d94567b6d2223106bdbf9f0
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17904-4153-73db-b278-07e29027efee.png
  Captured: 2026-10-26 16:21:32 UTC
  Source report: https://urlscan.io/result/01a17904-4153-73db-b278-07e29027efee/
  SHA-256: cfcfa230777668c79716bca07f13794df3c8c1143d94567b6d2223106bdbf9f0
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1790c-9d64-70ef-9f6e-515faf550ff2.png
  Captured: 2026-10-26 16:30:56 UTC
  Source report: https://urlscan.io/result/01a1790c-9d64-70ef-9f6e-515faf550ff2/
  SHA-256: f86577824ddff3ee5f10167fbf6a532e7d7a709f0d78f2b3d4fd0da5b9e61b91
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/a098f8b8-396a-4ffc-8cfb-0682dc0e70b1.png
  Captured: 2026-10-26 16:48:27 UTC
  Source report: https://radar.cloudflare.com/scan/a098f8b8-396a-4ffc-8cfb-0682dc0e70b1
  SHA-256: c6fbc5232199ef0c97fd08eb82b57fe81d689d30ec8e5589d72d8063feec8d96
- URLQuery: https://screenshots.phishdestroy.io/uq/d5ba1dc9-0831-49a3-9fb2-6ab4efe008f7.png
  Source report: https://urlquery.net/report/d5ba1dc9-0831-49a3-9fb2-6ab4efe008f7
  SHA-256: 9ecca0a18bbb9ed46705d306bcbff6863d8136fe954a4464383aa009071df789

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T16:33:10Z",
        "uuid": "01a178fe-658b-717d-ace3-b90666b5ce61",
        "scanned_at": "2026-10-26T16:15:08Z",
        "final_url": "https://mmdancr.sbs/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://mmdancr.sbs/",
                "from": "http://mmdancr.sbs/",
                "status": 307
            }
        ],
        "ip": "43.173.22.50",
        "ips": [
            "43.173.22.50"
        ],
        "asns": [
            "132203"
        ],
        "countries": [
            "ID"
        ],
        "doc_hash": "00dde72234d3b1239eadda79ca649cfd0bc09147d872ebf04b75853d5fe61797",
        "cookies": [
            "PHPSID"
        ],
        "tls": {
            "san": [
                "mmdancr.sbs"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "mmdancr.sbs",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-23T06:22:04Z",
            "valid_from": "2026-10-25T06:22:05Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "workerman",
            "content-type": "text/html;charset=utf-8",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T16:48:50Z",
        "uuid": "a098f8b8-396a-4ffc-8cfb-0682dc0e70b1",
        "scanned_at": "2026-10-26T16:48:27Z",
        "final_url": "https://mmdancr.sbs/",
        "status": 200,
        "history": [
            {
                "url": "https://mmdancr.sbs/",
                "status": 200
            }
        ],
        "dom_hash": "7656b9b1f13f5f8d674a14c127722e9170fdbc4e0889f4581978d6cbfc3824fd",
        "doc_hash": "582b462e3bce4b0156c42202cc9a4da90703dd3e892b9388733ce705b7bd7e1c",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "Phishing",
            "Security threats",
            "New Domains",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mmdancr.sbs",
                "type": "A",
                "value": "43.173.22.50"
            }
        ],
        "dnssec_valid": false,
        "ip": "43.173.22.50",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "NameMart Pte. Ltd.",
            "created": "2026-10-25T07:04:01Z",
            "expires": "2027-10-25T23:59:59Z",
            "nameservers": [
                "ns1.domainnamedns.com",
                "ns2.domainnamedns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T16:47:28Z",
        "analysis_at": "2026-10-26T13:10:57Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 5,
            "suspicious": 0,
            "undetected": 36
        },
        "detections": {
            "CRDF": "malicious",
            "Webroot": "malicious",
            "SOCRadar": "phishing",
            "LevelBlue": "phishing",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "Webroot": "Malware Sites",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "NameMart Pte. Ltd.",
        "created": "2026-10-25T07:04:01Z",
        "expires": "2027-10-25T23:59:59Z",
        "first_seen": "2026-10-25T07:25:32Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "support.namens.net",
                "value": "ns1.domainnamedns.com"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns2.domainnamedns.com"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns3.domainnamedns.com"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns4.domainnamedns.com"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns1.domainnamedns.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "43.173.22.50"
            }
        ],
        "dns_at": "2026-10-26T13:11:33Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "mmdancr.sbs"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "56b0c84b1b2af72d02c2a068ff1399c9021",
            "sha256": "39d2e2db2eb240a0a6503da82af184b48b28f5f98c0526e8c31b8b11c6b31e61",
            "subject": "mmdancr.sbs",
            "valid_to": "2027-01-23T06:22:04Z",
            "valid_from": "2026-10-25T06:22:05Z"
        },
        "whois": {
            "registrar": "NameMart Pte. Ltd.",
            "registrar_iana_id": "4162",
            "registrar_url": "https://www.namemart.com",
            "created": "2026-10-25T07:04:01Z",
            "expires": "2027-10-25T23:59:59Z",
            "status": [
                "addPeriod",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "ns1.domainnamedns.com",
                "ns2.domainnamedns.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:49:03Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "mmdancr.sbs"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-26T16:16:10Z",
            "first": "2026-10-26T16:16:10Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 8426
        },
        "social_tags": {
            "title": "Verify you are human"
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 37,
                "tls": 222,
                "wait": 188,
                "connect": 178,
                "download": 179
            },
            "response_ms": 804
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 22882,
            "co2_grams": 0.0008,
            "cleaner_than": 54
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "67.220.72.51",
                    "host": "ns4.domainnamedns.com"
                },
                {
                    "ip": "216.106.185.75",
                    "host": "ns1.domainnamedns.com"
                },
                {
                    "ip": "38.114.114.183",
                    "host": "ns2.domainnamedns.com"
                },
                {
                    "ip": "54.151.142.119",
                    "host": "ns3.domainnamedns.com"
                }
            ],
            "zone": "mmdancr.sbs"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "PHPSID",
                    "http_only": true
                }
            ]
        },
        "location": {
            "ip": "43.173.22.50",
            "asn": "132203",
            "org": "Shenzhen Tencent Computer Systems Company Limited",
            "city": "Jakarta",
            "country": "ID"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "mmdancr.sbs"
        },
        "dns": {
            "A": [
                "43.173.22.50"
            ],
            "NS": [
                "ns4.domainnamedns.com",
                "ns1.domainnamedns.com",
                "ns2.domainnamedns.com",
                "ns3.domainnamedns.com"
            ],
            "SOA": "{\"nsname\": \"ns1.domainnamedns.com\", \"hostmaster\": \"support.namens.net\", \"serial\": 1792912021, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 180}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "43.173.22.50",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://mmdancr.sbs"
            ]
        },
        "whois": {
            "registrar": "NameMart Pte. Ltd.",
            "created": "2026-10-25T07:04:01Z",
            "expires": "2027-10-25T23:59:59Z",
            "status": [
                "serverTransferProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.domainnamedns.com",
                "ns2.domainnamedns.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "workerman",
                "content-type": "text/html;charset=utf-8",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin"
            }
        }
    }
}
```