# PhishDestroy threat dossier — opiniontrades.xyz ================================================================ Fetched: 2026-06-30 10:56:21 UTC Canonical: https://phishdestroy.io/domain/opiniontrades.xyz/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 58/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 12/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, G-Data, Gridinsoft, Kaspersky Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 104.21.43.194 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: NameSilo, LLC !!! REGISTRAR INTEGRITY ALERT — NameSilo !!! NameSilo is a registrar documented by PhishDestroy as (1) publicly lying about received abuse reports, (2) shielding a $20M+ Monero-theft operation (xmrwallet.com) for 10 continuous years, and (3) retaliating against PhishDestroy by getting our X/Twitter account @Phish_Destroy banned after we published the evidence. Researchers/victims must ALWAYS CC compliance@icann.org on every abuse ticket — NameSilo has a track record of later claiming reports were never received. Primary sources: https://phishdestroy.io/namesilo-killed-our-twitter https://phishdestroy.io/xmrwallet-namesilo-exposed Nameservers: cosmin.ns.cloudflare.com, robin.ns.cloudflare.com Registered: 2026-03-03 Expires: 2027-03-03 Page title: Opinion Foundation ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E7 Expires: 2026-08-16 Status: INVALID chain Fingerprint: 7c9c22dbe5327c24986a9b5353017d2c3f314d677003359e003152d9e9b97a98 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-03-03 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-29 11:54:42 UTC (by PhishDestroy tracker) First reported: 2026-06-29 10:07:15 UTC (abuse notice filed) Last verified: 2026-06-30 12:20:35 UTC Neutralised: 2026-06-29 12:16:41 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f12cc-98fb-77ea-b54d-c2f7a2baf533/ Wayback Machine: https://web.archive.org/web/*/opiniontrades.xyz crt.sh CT logs: https://crt.sh/?q=%25.opiniontrades.xyz Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=opiniontrades.xyz AlienVault OTX: https://otx.alienvault.com/indicator/domain/opiniontrades.xyz URLhaus: https://urlhaus.abuse.ch/host/opiniontrades.xyz/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-29 12:00:19 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, opiniontrades.xyz, is actively engaged in fake survey phishing operations designed to harvest personally identifiable information (PII) and credentials under the guise of the Opinion Foundation. Analysis of the page title and infrastructure suggests the site presents fraudulent survey forms or reward offers to deceive visitors into disclosing sensitive data, including login credentials, payment details, or other personal information. Such campaigns are commonly used to facilitate identity theft, financial fraud, or subsequent targeted phishing attacks against affected individuals. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. The domain was registered on March 03, 2026, through NameSilo, LLC, a registrar frequently observed in phishing infrastructure due to its accessibility and minimal verification requirements. As of the latest assessment, opiniontrades.xyz resolves to the IP address 104.21.43.194, which is associated with content delivery networks commonly exploited to obfuscate hosting origins. VirusTotal detection metrics report that 6 out of 95 security vendors have flagged this domain as malicious, a detection ratio consistent with active but low-visibility phishing campaigns. No additional blocklist entries were identified at the time of analysis, though the domain remains in active status with no signs of takedown or remediation. Users who have visited opiniontrades.xyz or interacted with its content are advised to take immediate corrective actions to mitigate potential risks. Any credentials, payment details, or personal information entered on the site should be considered compromised and must be changed across all platforms where identical or similar credentials were used. Affected individuals should monitor financial accounts and credit reports for unauthorized activity, as harvested data may be exploited for fraudulent transactions or account takeovers. Browser data, including cookies and cached content, should be cleared to remove any residual tracking artifacts. If the site prompted for software downloads or extensions, devices should be scanned for malware using updated security tools. Organizations should update internal blocklists to prevent access to this domain and its associated IP address, while also reviewing logs for any prior connections from internal networks. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260629-4DE816 TLS cert SHA-256: 7c9c22dbe5327c24986a9b5353017d2c3f314d677003359e003152d9e9b97a98 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/opiniontrades.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=opiniontrades.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 172,677 domains (12,755 alive under monitoring, 159,332 confirmed takedowns/dead). Site: https://phishdestroy.io