# PhishDestroy domain threat record: pdv.topper.dpscloud.com.ar Content language: English Canonical HTML report: https://phishdestroy.io/domain/pdv.topper.dpscloud.com.ar/ Machine-readable companion: https://phishdestroy.io/domain/pdv.topper.dpscloud.com.ar/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-06 12:57:09 UTC - Last availability or vendor check: 2026-10-22 10:30:36 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 5/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: microsoft ## Stored infrastructure - Observed IP address: 162.159.140.98 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 307 - Registration date in stored WHOIS data: 2024-11-06 15:38:05 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a076ca-4a8b-76ef-b43f-77ada9f4e982/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/pdv.topper.dpscloud.com.ar - Certificate Transparency search: https://crt.sh/?q=%25.pdv.topper.dpscloud.com.ar - Web Archive lookup: https://web.archive.org/web/*/https://pdv.topper.dpscloud.com.ar/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview pdv.topper.dpscloud.com.ar is an impersonation phishing page dressed as a Topper sign-in portal. Its title reads "Iniciar sesión | Puntos de Venta - Topper" ("Log in | Points of Sale - Topper"), so it is aimed at Spanish-speaking users who expect a Topper point-of-sale account login. PhishDestroy first flagged it on 2026-09-06. As of 2026-10-19 the site was still online and its content now redirects visitors elsewhere. How the scam works The page copies a branded point-of-sale login so that anyone who reaches it through a link, a search result or a message believes they are signing in to a real Topper account. Whatever is typed into the form goes to the operators, not to Topper. With those credentials they can take over the account, reuse the password on other services, or stage further fraud from a trusted-looking session. Because the site now redirects, the same address can quietly send visitors to new destinations over time. Evidence Detection by security vendors is thin. Five of 89 VirusTotal engines flagged the address when it was checked on 2026-09-20: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. Crypto-focused blocklists carry more weight here. Besides PhishDestroy, the domain is listed by MetaMask and by SEAL, so wallet users who rely on those protections should see a warning. Do not read a clean result from most scanners as a sign that the page is safe. Infrastructure The page sits on a subdomain whose parent domain was registered on 2024-11-06, nearly two years before PhishDestroy detected it. The domain's age may help it slip past filters that distrust newly registered domains. Traffic is served through Cloudflare, Inc. on an address geolocated to Canada, so the real origin server is hidden behind the proxy. The Google Trust Services certificate gives the visitor a padlock icon, but the padlock says nothing about who runs the page. What to do If you entered a username or password on this page, change that password at once through Topper's official app or site, and change it anywhere else you reused it. Turn on two-factor authentication and review recent logins, devices and transactions for activity you do not recognize. Treat any follow-up messages about this "point of sale" account as suspect. Defenders should block the full hostname and its parent domain, watch for its redirect targets, and report it to Cloudflare and to Topper so it can be taken down. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a076ca-4a8b-76ef-b43f-77ada9f4e982/ VirusTotal report: https://www.virustotal.com/gui/domain/pdv.topper.dpscloud.com.ar Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=pdv.topper.dpscloud.com.ar Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:48:45 UTC ## Stored page captures - Primary capture: https://i.ibb.co/BVfQFH09/05c8011dae65.png Captured: 2026-09-06 12:57:09 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a076ca-4a8b-76ef-b43f-77ada9f4e982.png Captured: 2026-09-06 12:57:09 UTC Source report: https://urlscan.io/result/01a076ca-4a8b-76ef-b43f-77ada9f4e982/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/272ce2ab-0e61-45ff-9c59-db5d55fbaa2a.png Captured: 2026-09-06 13:03:38 UTC Source report: https://radar.cloudflare.com/scan/272ce2ab-0e61-45ff-9c59-db5d55fbaa2a SHA-256: 3768be18fd22c03df9c8f82ac256af194f2549962eb586215b2347037e2b516a - URLScan · 2026-09-06: https://screenshots.phishdestroy.io/us/01a075fb-ad9a-72b9-8ad9-858f9cad581e.png Captured: 2026-09-06 09:10:30 UTC Source report: https://urlscan.io/result/01a075fb-ad9a-72b9-8ad9-858f9cad581e/ SHA-256: b829a26100abe8c1be41f78449cef81a97b19f6c40c4d059e6aab6592a1605d5 - URLScan · 2026-09-06: https://screenshots.phishdestroy.io/us/01a076bc-d23d-715a-be19-30b340d82960.png Captured: 2026-09-06 12:41:27 UTC Source report: https://urlscan.io/result/01a076bc-d23d-715a-be19-30b340d82960/ SHA-256: b829a26100abe8c1be41f78449cef81a97b19f6c40c4d059e6aab6592a1605d5 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:48:23Z", "uuid": "01a076ca-4a8b-76ef-b43f-77ada9f4e982", "scanned_at": "2026-09-06T12:56:09Z", "final_url": "https://pdv.topper.dpscloud.com.ar/login", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://pdv.topper.dpscloud.com.ar/", "from": "http://pdv.topper.dpscloud.com.ar/", "status": 307 }, { "to": "https://pdv.topper.dpscloud.com.ar/login", "from": "https://pdv.topper.dpscloud.com.ar/", "status": 307 } ], "ip": "162.159.140.98", "domains": [ "api.pdv.topper.com.ar" ], "ips": [ "162.159.140.98" ], "asns": [ "13335" ], "countries": [ "US" ], "doc_hash": "d0388af529dfaffba02ff4c102452762ab115ddb415f6e88945005675a8cf246", "script_hashes": [ "366bf25844edee9606dd7492336fb9ad2d9869f8bfea1e543c9f185d61b797e7", "1ae3225acb68b63671b56c97efb7a754a38b1410474622e9b7af18566ad205e6", "f9f944ac8f915b8d6cf6a353f9ff391c0acfd1139278edc0dbfc5b025086f84c", "0a6fa3ff9c308deebbc1ba3e2170461a5ed4e79cb1094a6d4d4674c6800488bb", "3c6c41fc8174f88007e2f7c2f8d458fbc791aa1c08fa280ce8c56a2b38463c9e", "214daeb74aba5a19f5ba99a92957f268bebfdbaf82b1a275d3eb92fa3e0a2beb", "bc55f97e21fe8e3266700e161cedcaf06055cad6ca46602383545b313dd27cc6", "7c306e7862ecff1180ac90dc59d6af71a25780c2cb8d9b1a15353e4212f1f209", "ef6bf92fb1a4e992cd124eebff1d34e35d8638d9adc3ebe2973103fbdeaf4ea8", "6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e" ], "globals": [ "_sentryDebugIds", "_sentryDebugIdIdentifier", "webpackChunk_N_E", "__next_set_public_path__", "next", "__NEXT_DATA__", "__SSG_MANIFEST_CB", "__NEXT_P", "_N_E", "_sentryRewritesTunnelPath", "SENTRY_RELEASE", "_sentryRewriteFramesAssetPrefixPath", "_sentryRouteManifest", "__SENTRY__", "_", "__MIDDLEWARE_MATCHERS", "__BUILD_MANIFEST", "__SSG_MANIFEST" ], "cookies": [ "__cf_bm" ], "storage_keys": [ "sentryReplaySession" ], "tls": { "san": [ "pdv.topper.dpscloud.com.ar" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "pdv.topper.dpscloud.com.ar", "protocol": "QUIC", "valid_to": "2026-11-02T06:31:27Z", "valid_from": "2026-08-04T05:31:38Z" }, "domain_age_days": 565, "apex_age_days": 666, "tls_age_days": 33, "tls_valid_days": 90, "requests": 19, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 0, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-powered-by": "Next.js" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T03:59:20Z", "uuid": "272ce2ab-0e61-45ff-9c59-db5d55fbaa2a", "scanned_at": "2026-09-06T13:03:38Z", "final_url": "https://pdv.topper.dpscloud.com.ar/login", "status": 200, "redirected": "same-domain", "history": [ { "url": "https://pdv.topper.dpscloud.com.ar/", "status": 307 }, { "url": "https://pdv.topper.dpscloud.com.ar/login", "status": 200 } ], "dom_hash": "61cecd044483d7066473e6a5ea616cef18623561c2594b98f01761d033412187", "doc_hash": "3098468e800703a78ae4136cbff4a185fc5258b11176006ef1eef99fe82ad1c4", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "pdv.topper.dpscloud.com.ar", "type": "CNAME", "value": "prod-topper-pdv-frontend-2pm29.ondigitalocean.app" }, { "name": "pdv.topper.dpscloud.com.ar", "type": "CNAME", "value": "prod-topper-pdv-frontend-2pm29.ondigitalocean.app" } ], "dnssec_valid": false, "ip": "162.159.140.98", "verdict": { "tags": [ "dga domains" ], "malicious": true, "categories": [ "dga domains" ] }, "whois": { "registrar": "nicar", "created": "2024-11-06T16:38:05Z", "updated": "2025-10-22T10:08:51Z", "expires": "2026-11-06T00:00:00Z", "nameservers": [ "ns1.digitalocean.com", "ns3.digitalocean.com", "ns2.digitalocean.com" ] } } } ```