# PhishDestroy domain threat record: nbddut-i6esa064.vercel.app Content language: English Canonical HTML report: https://phishdestroy.io/domain/nbddut-i6esa064.vercel.app/ Machine-readable companion: https://phishdestroy.io/domain/nbddut-i6esa064.vercel.app/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-22 20:28:53 UTC - Last availability or vendor check: 2026-10-22 23:06:53 UTC - Stored record updated: 2026-10-23 03:30:42 UTC - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ledger ## Stored infrastructure - Observed IP address: 64.29.17.195 - Registrar in stored WHOIS data: Vercel Inc. - Last stored HTTP status: 200 - Registration date (registry RDAP, vercel.app): 2020-01-28 03:03:04 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1654c-0bc2-70af-93a6-1e7d700722cb/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/nbddut-i6esa064.vercel.app - Certificate Transparency search: https://crt.sh/?q=%25.nbddut-i6esa064.vercel.app - Web Archive lookup: https://web.archive.org/web/*/https://nbddut-i6esa064.vercel.app/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored page captures - Primary capture: https://i.ibb.co/BHzskv37/070e828d47c7.png Captured: 2026-10-22 20:28:53 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a1654c-0bc2-70af-93a6-1e7d700722cb.png Captured: 2026-10-22 20:28:53 UTC Source report: https://urlscan.io/result/01a1654c-0bc2-70af-93a6-1e7d700722cb/ - URLScan capture 2: https://urlscan.io/screenshots/01a1213f-9a5e-7447-bbe0-5177b219cffc.png Captured: 2026-10-10 17:22:43 UTC Source report: https://urlscan.io/result/01a1213f-9a5e-7447-bbe0-5177b219cffc/ - URLScan · 2026-10-01: https://screenshots.phishdestroy.io/us/01a0f4fa-302e-7089-b807-7e9e62ee30ff.png Captured: 2026-10-01 01:00:43 UTC Source report: https://urlscan.io/result/01a0f4fa-302e-7089-b807-7e9e62ee30ff/ SHA-256: 717a8b8cbb538ee200c737fe7ef2811b3a53a46a8f28a1dfe0071a9345185180 - URLScan · 2026-10-01: https://screenshots.phishdestroy.io/us/01a0f5c9-ba03-7449-bcf3-a2a5219ced9e.png Captured: 2026-10-01 04:47:20 UTC Source report: https://urlscan.io/result/01a0f5c9-ba03-7449-bcf3-a2a5219ced9e/ SHA-256: f4d6650b0300b6a6c331167539c5dcdbde7e7c04c329875720ea00a192f91125 - URLScan · 2026-10-06: https://screenshots.phishdestroy.io/us/01a11176-31b5-7569-b71d-e1d4b42d8cd0.png Captured: 2026-10-06 13:45:28 UTC Source report: https://urlscan.io/result/01a11176-31b5-7569-b71d-e1d4b42d8cd0/ SHA-256: 1b553fbe08efa8f2c94231ce073ca48721821ae4a4bfb25fd947895160684e0f - URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a1213f-5b6e-702b-933b-300373f5f0d3.png Captured: 2026-10-09 15:19:29 UTC Source report: https://urlscan.io/result/01a1213f-5b6e-702b-933b-300373f5f0d3/ SHA-256: 6eac70d7e53e1c3445f329ba45ccde2bfb317909305ab0b4a7d6b697fac0d6c2 - URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a1287a-b31a-72ab-baa7-f9d5e7616bcd.png Captured: 2026-10-11 01:01:38 UTC Source report: https://urlscan.io/result/01a1287a-b31a-72ab-baa7-f9d5e7616bcd/ SHA-256: 730d691fb67fefe066c5d98e3af4c85af7d267710c0527550f535faedec75a79 - URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a13973-376f-75b6-9cab-f220b40ac88b.png Captured: 2026-10-14 08:07:01 UTC Source report: https://urlscan.io/result/01a13973-376f-75b6-9cab-f220b40ac88b/ SHA-256: cc6f9166e60e55f13070ef4fa749636d708c919d96c3a3207406d2a45bb9b83c ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T21:43:27Z", "uuid": "01a1654c-0bc2-70af-93a6-1e7d700722cb", "scanned_at": "2026-10-22T20:27:35Z", "final_url": "https://nbddut-i6esa064.vercel.app/landing.html", "status": 200, "ip": "64.29.17.195", "ips": [ "64.29.17.195" ], "asns": [ "16509" ], "countries": [ "US" ], "doc_hash": "b6ae90bd6c225501086486222a69f12adf69a68c1daa74fdc7ccc7824fd2cded", "script_hashes": [ "cd6c62969f60850af0301f8002e8c4e3359bbeba9fa8b5b121b5ac3834b3a2d4", "edd4a00700c978a8c96629862a5bed0430a2ebb8f4fb052753d070e2c5bc6c5d", "27a5959fb8d5f1408e5d220b2b007c2e05f7188ce49ffb6d3d3d06ba5e33e587", "4d83be15a096eaddc3c11959c3e5fbe0e8cfdc25224cd49cb23db1e0658a346b" ], "globals": [ "LedgerI18n" ], "tls": { "san": [ "*.vercel.app" ], "cipher": "AES_128_GCM", "issuer": "WR1", "subject": "*.vercel.app", "protocol": "TLS 1.3", "valid_to": "2026-11-27T19:48:08Z", "valid_from": "2026-08-29T19:48:09Z" }, "domain_age_days": 22, "apex_age_days": 22, "tls_age_days": 54, "tls_valid_days": 89, "requests": 22, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "ledger" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Ledger" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "Vercel", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=63072000; includeSubDomains; preload" } }, "vt": { "v": 1, "fetched_at": "2026-10-22T20:38:30Z", "analysis_at": "2026-10-18T19:45:09Z", "stats": { "timeout": 0, "harmless": 50, "malicious": 8, "suspicious": 0, "undetected": 34 }, "detections": { "ESET": "phishing", "G-Data": "phishing", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "Kaspersky": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing" }, "reputation": 0, "tags": [ "dga" ], "categories": { "alphaMountain.ai": "Information Technology, Phishing (alphaMountain.ai)" }, "registrar": "Tucows Domains Inc", "created": "2020-01-28T03:03:04Z", "expires": "2026-01-28T03:03:04Z", "updated": "2025-01-26T03:25:55Z", "first_seen": "2026-09-30T09:07:13Z", "dns": [ { "ttl": 300, "type": "A", "value": "216.198.79.67" }, { "ttl": 300, "type": "A", "value": "64.29.17.67" } ], "dns_at": "2026-10-18T19:45:21Z", "jarm": "3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fb", "cert": { "san": [ "*.vercel.app" ], "issuer": "Google Trust Services / WR1", "serial": "f7911168ffa7d0f4135e24792e7a52a8", "sha256": "8f46c4a0a289bfde4060d06986f2af761ee62d668dde972e6bef4687ee4f6093", "subject": "*.vercel.app", "valid_to": "2026-11-27T19:48:08Z", "valid_from": "2026-08-29T19:48:09Z" }, "whois": { "registrar": "Tucows Domains Inc", "registrar_iana_id": "69", "registrar_url": "http://www.tucows.com", "created": "2020-01-28T03:03:04Z", "updated": "2025-01-26T03:25:55Z", "expires": "2026-01-28T03:03:04Z", "status": [ "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "ns1.vercel-dns-3.com", "ns2.vercel-dns-3.com", "ns3.vercel-dns-3.com", "ns4.vercel-dns-3.com" ], "dnssec": "unsigned" } } } ```