# PhishDestroy threat dossier — privetkort.com ================================================================ Fetched: 2026-08-01 01:05:11 UTC Canonical: https://phishdestroy.io/domain/privetkort.com/ ## VERDICT ---------------------------------------------------------------- ACTIVE THREAT — multiple warning signs Composite threat score: 57/100 (PhishDestroy scoring — see methodology below) Targeted brand: telegram ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 31.76.118.114 (PL, Warsaw) ASN: AS202226 Emil Vitukhnovskii trading as Great Flower Hosting org: Great Flower Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED !!! REGISTRAR INTEGRITY ALERT — NiceNIC !!! NiceNIC International: over 90% of its registered domains are associated with illegal content; documented systematic abuse-report non-response. Primary sources: https://phishdestroy.io/nicenic-real https://phishdestroy.io/nicenic-verdict Nameservers: ns3.my-ndns.com, ns4.my-ndns.com Registered: 2026-07-26 Expires: 2027-07-26 Page title: PRIVET KORT — Теннисная школа ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YE1 Expires: 2026-10-28 Status: INVALID chain Fingerprint: fca40d180971f0e2ae259d5123c1775623ffcc4cdb7298219ed1c0108c4938ff ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-26 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-31 20:29:56 UTC (by PhishDestroy tracker) Last verified: 2026-08-01 01:03:09 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019fb984-a952-722a-b8e6-aedef146c99a/ Wayback Machine: https://web.archive.org/web/*/privetkort.com crt.sh CT logs: https://crt.sh/?q=%25.privetkort.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=privetkort.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/privetkort.com URLhaus: https://urlhaus.abuse.ch/host/privetkort.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-31 20:31:51 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Generic phishing campaign detected on privetkort.com Analysis on July 31 2026 confirms that the recently registered domain privetkort.com is being used in an active generic phishing campaign. The domain was created on July 26 2026 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolution points exclusively to the IPv4 address 31.76.118.114, and the authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. The domain has been added to one security blocklist and is listed as blocked by the PhishDestroy feed, indicating that at least one downstream protector is already denying traffic. VirusTotal records show that the domain was scanned by 91 antivirus and URL‑reputation vendors; none of the scanners reported a detection at the time of analysis, but the absence of a flag does not imply safety. No public information is available regarding SSL/TLS configuration, HTTP response codes, page title, or any observed payload, so the exact phishing landing page remains unknown. The limited visibility means that defenders cannot yet confirm the targeted brand or the specific credential‑harvesting technique, but the registration timing and immediate blocklist appearance suggest a fast‑flux style deployment. Organizations should proactively block privetkort.com at network perimeter devices, DNS resolvers, and endpoint security solutions. Continuous monitoring of the IP address 31.76.118.114 for additional malicious activity is advised, as well as periodic re‑scanning of the domain with updated URL reputation services. If any user reports suspicious emails referencing privetkort.com, incident responders should treat them as potential phishing attempts and collect relevant headers for further attribution. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 40d1a7964a911dcc8e7c8c9863710d65 TLS cert SHA-256: fca40d180971f0e2ae259d5123c1775623ffcc4cdb7298219ed1c0108c4938ff ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/privetkort.com/ JSON API: https://api.destroy.tools/v1/check?domain=privetkort.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 196,233 domains (101,036 alive under monitoring, 27,265 confirmed neutralized). Site: https://phishdestroy.io