# PhishDestroy domain threat record: picassoapp.su

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/picassoapp.su/
Machine-readable companion: https://phishdestroy.io/domain/picassoapp.su/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-19 06:56:30 UTC
- Last availability or vendor check: 2026-10-22 10:30:41 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/91
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: ARDIS-SU
- Registrar country in stored WHOIS data: Unknown
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2024-12-12 12:53:50 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0b88e-b5a9-77e9-8dc1-f5d7c6fef565/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/picassoapp.su
- Certificate Transparency search: https://crt.sh/?q=%25.picassoapp.su
- Web Archive lookup: https://web.archive.org/web/*/https://picassoapp.su/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
picassoapp.su presents itself as a download portal for the Picasso App, titled "Picasso App Download Latest Version (v10.8.8) For Android." It targets Android users who search for the app outside official stores and land on a page that borrows the brand's name. PhishDestroy first flagged the domain on 2026-09-19 and classifies it as impersonation phishing. As of 2026-10-19 the site was still online and serving its content.

How the scam works
Pages like this rely on the popularity of a named app and a precise-looking version number, here v10.8.8, to seem current and legitimate. The visitor is pushed to sideload an Android package from a source the brand does not control. That means the user has no assurance about what the file contains or what permissions it will request. Victims of this kind of impersonation risk installing tampered software and exposing accounts, personal data and any wallets or credentials stored on the phone.

Evidence
Detection is narrow but consistent. Six of 91 VirusTotal engines flagged the domain in a 2026-09-27 scan: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and VIPRE. Crypto-focused blocklists also list it, including those maintained by MetaMask and the SEAL security alliance, alongside PhishDestroy's own. Three AlienVault OTX threat pulses reference the domain, so other researchers have tracked it independently.

Infrastructure
The domain was registered on 2024-12-12 through ARDIS-SU under Russia's legacy .su zone. It operated for roughly 21 months before PhishDestroy detected it, which is a long runway for a lure page. Traffic resolves to Cloudflare, Inc. address space geolocated to Canada. That setup places the site behind a proxy network and conceals where the actual server sits.

What to do
If you installed an app from this site, uninstall it, run a reputable mobile security scan, and review which apps hold accessibility, SMS or device-admin permissions. Change passwords for any accounts used on that phone, starting with email and banking, and re-enable two-factor authentication from a clean device. If a crypto wallet lives on the same device, move funds to a new wallet created on trusted hardware. Get the Picasso App only through channels the developer controls. Defenders should block picassoapp.su at DNS and proxy level and add it to mobile threat defense policies.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0b88e-b5a9-77e9-8dc1-f5d7c6fef565/
VirusTotal report: https://www.virustotal.com/gui/domain/picassoapp.su
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=picassoapp.su
Archived copy: https://web.archive.org/web/20260922130913/https://picassoapp.su/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:39:44 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/b5K2sxHy/18e2fcebf9f7.png
  Captured: 2026-09-19 07:27:29 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0b88e-b5a9-77e9-8dc1-f5d7c6fef565.png
  Captured: 2026-09-19 07:27:29 UTC
  Source report: https://urlscan.io/result/01a0b88e-b5a9-77e9-8dc1-f5d7c6fef565/
- URLScan capture 2: https://urlscan.io/screenshots/01a0adf6-847b-72f5-bf84-4e7f09d0802d.png
  Captured: 2026-09-19 06:56:30 UTC
  Source report: https://urlscan.io/result/01a0b88e-b5a9-77e9-8dc1-f5d7c6fef565/
- URLQuery: https://screenshots.phishdestroy.io/uq/db902c73-7e6b-4582-82df-6f7b0a06300a.png
  Captured: 2026-09-19 07:43:48 UTC
  Source report: https://urlquery.net/report/db902c73-7e6b-4582-82df-6f7b0a06300a
  SHA-256: fb9dbed9e1ec1f99fd46de853299d9f6f721a5420db362c06c8d94ae363e2d7a
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/46b44c0a-daf6-45a0-a7ab-5cde8e58576c.png
  Captured: 2026-09-19 06:58:56 UTC
  Source report: https://radar.cloudflare.com/scan/46b44c0a-daf6-45a0-a7ab-5cde8e58576c
  SHA-256: 68b0f3efae09f1944d990bb2c17be9e9b30b6e10f9f0a71020122db788e3bbea
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06ad0-bde7-7256-9e83-4801804d47a3.png
  Captured: 2026-09-04 05:07:47 UTC
  Source report: https://urlscan.io/result/01a06ad0-bde7-7256-9e83-4801804d47a3/
  SHA-256: 5ee9dbdb5651d5a3b4eb091ef0107990cdb11750cd114ab70bd1e13d5021ac31
- URLScan · 2026-09-09: https://screenshots.phishdestroy.io/us/01a083d9-630d-7509-9845-60ba11797b9d.png
  Captured: 2026-09-09 01:47:45 UTC
  Source report: https://urlscan.io/result/01a083d9-630d-7509-9845-60ba11797b9d/
  SHA-256: 5ee9dbdb5651d5a3b4eb091ef0107990cdb11750cd114ab70bd1e13d5021ac31
- URLScan · 2026-09-19: https://screenshots.phishdestroy.io/us/01a0b895-b3b0-7200-9121-f3289f6c5dd4.png
  Captured: 2026-09-19 07:33:39 UTC
  Source report: https://urlscan.io/result/01a0b895-b3b0-7200-9121-f3289f6c5dd4/
  SHA-256: 5ee9dbdb5651d5a3b4eb091ef0107990cdb11750cd114ab70bd1e13d5021ac31
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d7ac-88f0-73eb-b5f4-9c7b88b5351d.png
  Captured: 2026-09-25 08:26:51 UTC
  Source report: https://urlscan.io/result/01a0d7ac-88f0-73eb-b5f4-9c7b88b5351d/
  SHA-256: 5ee9dbdb5651d5a3b4eb091ef0107990cdb11750cd114ab70bd1e13d5021ac31
- URLScan · 2026-10-03: https://screenshots.phishdestroy.io/us/01a100e3-f8fb-716f-9fb2-0ab601d44b4d.png
  Captured: 2026-10-03 08:31:49 UTC
  Source report: https://urlscan.io/result/01a100e3-f8fb-716f-9fb2-0ab601d44b4d/
  SHA-256: 5ee9dbdb5651d5a3b4eb091ef0107990cdb11750cd114ab70bd1e13d5021ac31

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:27:03Z",
        "uuid": "01a0b88e-b5a9-77e9-8dc1-f5d7c6fef565",
        "scanned_at": "2026-09-19T07:26:03Z",
        "final_url": "https://picassoapp.su/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://picassoapp.su/",
                "from": "http://picassoapp.su/",
                "status": 307
            }
        ],
        "ip": "2a06:98c1:3121::3",
        "domains": [
            "fonts.gstatic.com",
            "library.generateblocks.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.250.154.94",
            "178.128.151.156",
            "188.114.96.3",
            "2a00:1450:4001:c0f::5f",
            "2a06:98c1:3121::3"
        ],
        "asns": [
            "15169",
            "14061",
            "13335"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "doc_hash": "1a9d6b5fa632697f65e7436c8e64e5ca0074869e58d4628b6b84d8cd2c6fe1e3",
        "script_hashes": [
            "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf",
            "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89",
            "ca88b4de148cd36d2bce3b8004d4b0093fa10fe6a5d97307ad0086fb11854357",
            "5af760e4297b064a2150dcd5f63d748a06dfa8b618c9e9d43a87c4ac74fa3974",
            "c28374dac3c83bfa51214ac35d1e63dadd37f15c958fe2e60c76cde5fa156f56",
            "3310986e26439bd35318188bd35b0c326bd3334e6699ca0469fd4f0b7d497098",
            "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3"
        ],
        "globals": [
            "jQuery",
            "generatepressMenu",
            "generatepressBackToTop",
            "_wpemojiSettings",
            "twemoji",
            "wp"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports"
        ],
        "tls": {
            "san": [
                "picassoapp.su",
                "*.picassoapp.su"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "picassoapp.su",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-23T21:55:34Z",
            "valid_from": "2026-07-25T20:58:19Z"
        },
        "domain_age_days": 645,
        "apex_age_days": 645,
        "tls_age_days": 55,
        "tls_valid_days": 90,
        "requests": 34,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:33:40Z",
        "uuid": "46b44c0a-daf6-45a0-a7ab-5cde8e58576c",
        "scanned_at": "2026-09-19T06:58:56Z",
        "final_url": "https://picassoapp.su/",
        "status": 200,
        "history": [
            {
                "url": "https://picassoapp.su/",
                "status": 200
            }
        ],
        "dom_hash": "8694f1fc6773af174d709e1d4c848e22f0f3eed7e0f1e4f8f8dba8a48287bf04",
        "doc_hash": "67c9378089da7d7070a00ba04a04271a6d52d1fde3f3bae91ccd2ad298529916",
        "domain_risks": [
            "Shareware/Freeware",
            "Technology"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "picassoapp.su",
                "type": "A",
                "value": "104.21.82.160"
            },
            {
                "name": "picassoapp.su",
                "type": "A",
                "value": "172.67.159.89"
            },
            {
                "name": "picassoapp.su",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:9f59"
            },
            {
                "name": "picassoapp.su",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:52a0"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.82.160",
        "whois": {
            "registrar": "ARDIS-SU",
            "created": "2024-12-12T13:53:50Z",
            "expires": "2026-12-12T13:53:50Z",
            "nameservers": [
                "gail.ns.cloudflare.com",
                "roan.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T04:50:27Z",
        "analysis_at": "2026-10-21T09:20:18Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 4,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "ARDIS-SU",
        "first_seen": "2024-12-12T22:11:42Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "gail.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.82.160"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "roan.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:9f59"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:52a0"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "gail.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.159.89"
            }
        ],
        "dns_at": "2026-10-21T09:20:39Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "picassoapp.su",
                "*.picassoapp.su"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "9288041265e9ef5713451ae8e80e1081",
            "sha256": "e5a8a91135c4f28fe4246f19c0250f50160e76f18f6735d333c4de9e94e5bb6a",
            "subject": "picassoapp.su",
            "valid_to": "2026-12-21T22:15:21Z",
            "valid_from": "2026-09-22T21:16:56Z"
        },
        "whois": {
            "registrar": "ARDIS-SU"
        }
    }
}
```