# PhishDestroy threat dossier — parafi.org ================================================================ Fetched: 2026-07-08 11:39:54 UTC Canonical: https://phishdestroy.io/domain/parafi.org/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 90/100 (PhishDestroy scoring — see methodology below) Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: referer_split) (score: 1/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 5/91 security vendors flagged this domain Flagging vendors: ChainPatrol, alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 76.76.21.21 (CY, Larnaca) ASN: ASAS16509 AMAZON-02 - Amazon.com, Inc., US Hosting org: AS47583 Hostinger International Limited Registrar: HOSTINGER operations, UAB Nameservers: ns1.dns-parking.com, ns2.dns-parking.com Registered: 2025-07-07 Expires: 2026-07-07 Page title: ParaFi | Blockchain and Digital Asset Investment Firm HTTP response: 200 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2025-07-07 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-07 15:55:14 UTC (by PhishDestroy tracker) Last verified: 2026-07-08 12:20:35 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f3cda-e84b-717d-9370-8a83848b32d2/ Wayback Machine: https://web.archive.org/web/*/parafi.org crt.sh CT logs: https://crt.sh/?q=%25.parafi.org Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=parafi.org AlienVault OTX: https://otx.alienvault.com/indicator/domain/parafi.org URLhaus: https://urlhaus.abuse.ch/host/parafi.org/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-07 16:04:55 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] The domain parafi.org poses a potential threat of credential theft through brand impersonation. It is designed to mimic a legitimate investment firm, thereby misleading users into providing sensitive personal and financial information. The use of a legitimate-sounding title 'ParaFi | Blockchain and Digital Asset Investment Firm' increases its credibility, potentially deceiving visitors into believing they are interacting with a trusted entity. Technical analysis reveals the domain parafi.org was created on July 07, 2025, and is registered through HOSTINGER operations, UAB. The site's SSL certificate is issued by Let's Encrypt, a popular choice for securing web traffic, which may give users a false sense of security. The domain currently resolves to IP address 2.57.91.91. Notably, VirusTotal reports that 1 out of 95 security vendors have flagged this domain, indicating a low but significant detection rate of suspicious activity. Users who have visited parafi.org should immediately check for any unauthorized transactions or changes in their accounts. It is crucial to update passwords and implement two-factor authentication on affected accounts. Additionally, users should remain vigilant and educate themselves on recognizing phishing attempts. Reporting encounters with this domain to their financial institutions and relevant cybersecurity authorities can help prevent further exploitation. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 89cce466b94e917cd46ccac704997b42 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/parafi.org/ JSON API: https://api.destroy.tools/v1/check?domain=parafi.org Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 175,932 domains (13,101 alive under monitoring, 161,863 confirmed takedowns/dead). Site: https://phishdestroy.io