# PhishDestroy threat dossier — nuatlas.online ================================================================ Fetched: 2026-07-01 14:03:33 UTC Canonical: https://phishdestroy.io/domain/nuatlas.online/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 95/100 (PhishDestroy scoring — see methodology below) Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 1/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 18/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, Cluster25, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, Lionic, OpenPhish, Seclookup, SOCRadar, Sophos, Webroot AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 69.49.241.79 (BR, Vinhedo) ASN: AS31898 Oracle Corporation Hosting org: Oracle Corporation Registrar: Dynadot Inc Nameservers: ns1.dyna-ns.net, ns2.dyna-ns.net Registered: 2026-06-27 Expires: 2027-06-27 HTTP response: 406 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-27 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-30 19:53:42 UTC (by PhishDestroy tracker) Last verified: 2026-07-01 12:20:36 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f19a9-80fc-7094-9516-7105955e4d93/ Wayback Machine: https://web.archive.org/web/*/nuatlas.online crt.sh CT logs: https://crt.sh/?q=%25.nuatlas.online Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=nuatlas.online AlienVault OTX: https://otx.alienvault.com/indicator/domain/nuatlas.online URLhaus: https://urlhaus.abuse.ch/host/nuatlas.online/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-30 19:56:12 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] nuatlas.online is currently active and poses a significant threat as a generic phishing domain. This domain has been flagged by multiple security vendors, indicating that it is being used to host phishing pages designed to steal sensitive information from unsuspecting users. The infrastructure analysis reveals that the domain is registered through Dynadot Inc and was created on June 27, 2026. It resolves to the IP address 69.49.241.79 and utilizes a Let's Encrypt SSL certificate, which can lend a false sense of security to visitors. Analysis indicates that 16 out of 95 security vendors on VirusTotal have flagged nuatlas.online as malicious. This suggests a moderate to high level of confidence in the domain's involvement in phishing activities. The domain was registered through Dynadot Inc on June 27, 2026, and currently resolves to the IP address 69.49.241.79. The use of a Let's Encrypt SSL certificate, while legitimate, is a common tactic among phishers to bypass basic security checks and gain user trust. The domain's elevated risk level is further supported by the number of security vendors flagging it, indicating that it has been observed in various phishing campaigns. If users have visited nuatlas.online, they should immediately check their accounts for any unauthorized activity, especially if they entered any sensitive information such as login credentials or personal data. It is recommended to change passwords and enable two-factor authentication (2FA) on all affected accounts. Users should also monitor their financial statements and credit reports for any signs of fraud. Additionally, they should consider running a full system scan with their antivirus software to ensure that no malware was installed. Reporting the incident to their respective security teams or IT departments is advised to prevent further damage and to help mitigate the spread of this phishing domain. ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/nuatlas.online/ JSON API: https://api.destroy.tools/v1/check?domain=nuatlas.online Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 173,494 domains (13,312 alive under monitoring, 159,499 confirmed takedowns/dead). Site: https://phishdestroy.io