# PhishDestroy domain threat record: projectp-distribution.store

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/projectp-distribution.store/
Machine-readable companion: https://phishdestroy.io/domain/projectp-distribution.store/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-11 03:31:02 UTC
- Last availability or vendor check: 2026-10-22 10:21:19 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 7/89
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 217.160.0.200
- Registrar in stored WHOIS data: IONOS SE
- Registrar country in stored WHOIS data: DE
- Last stored HTTP status: 200
- Registration date (registry RDAP, projectp-distribution.store): 2026-09-08 14:20:53 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a08e83-7bff-728a-9526-854cbc0e0ecb/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/projectp-distribution.store
- Certificate Transparency search: https://crt.sh/?q=%25.projectp-distribution.store
- Web Archive lookup: https://web.archive.org/web/*/https://projectp-distribution.store/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
projectp-distribution.store is an impersonation phishing site. Its name presents it as the official distribution channel for a project, and wallet-security blocklists have flagged it, which places its targets among crypto wallet users. PhishDestroy first saw it on 2026-09-11. As of 2026-10-19 the site was still online and serving live content, more than five weeks after it was first flagged.

How the scam works
Fake distribution and claim pages usually copy the look and wording of a real project. They tell visitors an allocation or reward is waiting, and to collect it the victim must connect a wallet and approve a transaction, or type in a recovery phrase. Either step gives the operator control over the funds. An approval can let them sweep tokens, and a seed phrase hands over the entire wallet. The page title shows only the bare domain name, so the browser tab gives no clue about which brand the site is copying.

Evidence
Several independent sources agree. MetaMask and the SEAL security alliance both list the domain, alongside PhishDestroy, so wallet users relying on those protections should see a warning. Spamhaus classifies it as a phishing domain in its DBL, and four AlienVault OTX threat pulses reference it. On VirusTotal, 7 of 89 engines flagged it as of 2026-09-24: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, Kaspersky and SOCRadar. That is a minority of engines, so many scanners still let it through, and the wallet-focused blocklists matter more here.

Infrastructure
The domain was registered on 2026-09-08 and was already being flagged three days later. A fresh domain put into use this quickly is typical of a disposable phishing setup. It is registered through IONOS SE and hosted on IONOS SE's network in Germany at 217.160.0.200. Registration and hosting sit with the same provider.

What to do
If you connected a wallet to this site, use a token-approval checker to revoke any permissions you granted it. Move your remaining assets to a fresh wallet if you signed anything you did not fully understand. If you entered a recovery phrase, treat that wallet as fully compromised and transfer the funds to a new seed right away. Only claim allocations through a project's verified official channels. Defenders should block the domain and its hosting IP at DNS and proxy level and use the Spamhaus DBL and wallet blocklists to catch similar distribution lures. Abuse reports can go to IONOS SE, since the site is still live.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a08e83-7bff-728a-9526-854cbc0e0ecb/
VirusTotal report: https://www.virustotal.com/gui/domain/projectp-distribution.store
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=projectp-distribution.store
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:44:35 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/d44QKsdX/b4a6821dcd1f.png
  Captured: 2026-09-11 03:31:02 UTC
- URLScan capture: https://urlscan.io/screenshots/01a08e83-7bff-728a-9526-854cbc0e0ecb.png
  Captured: 2026-09-11 03:31:02 UTC
  Source report: https://urlscan.io/result/01a08e83-7bff-728a-9526-854cbc0e0ecb/
- URLQuery: https://screenshots.phishdestroy.io/uq/97160289-f428-4e73-90c3-7e9925a72624.png
  Captured: 2026-09-11 03:35:36 UTC
  Source report: https://urlquery.net/report/97160289-f428-4e73-90c3-7e9925a72624
  SHA-256: f45502f5475402a3782b4d20ab296f247dcd931757d0607a32fa52e8ef543dbd
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/9f5c942d-39af-402c-a588-4f53a08796eb.png
  Captured: 2026-09-11 03:40:27 UTC
  Source report: https://radar.cloudflare.com/scan/9f5c942d-39af-402c-a588-4f53a08796eb
  SHA-256: 014e221a3afa14d8ba45e24356fb9325090f5b6ac313b53475ea44b33643a477

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:20:06Z",
        "uuid": "01a08e83-7bff-728a-9526-854cbc0e0ecb",
        "scanned_at": "2026-09-11T03:29:42Z",
        "final_url": "http://projectp-distribution.store/",
        "redirects": [
            {
                "to": "https://projectp-distribution.store/",
                "from": "http://projectp-distribution.store/",
                "status": 307
            },
            {
                "to": "http://projectp-distribution.store/",
                "from": "https://projectp-distribution.store/",
                "status": 307
            }
        ],
        "globals": [
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass",
            "reloadButtonClick",
            "downloadButtonClick",
            "detailsButtonClick",
            "setAutoFetchState"
        ],
        "domain_age_days": 1,
        "apex_age_days": 1,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 86,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:32:32Z",
        "uuid": "9f5c942d-39af-402c-a588-4f53a08796eb",
        "scanned_at": "2026-09-11T03:40:27Z",
        "final_url": "http://projectp-distribution.store/",
        "status": 200,
        "redirected": "same-domain",
        "history": [
            {
                "url": "http://projectp-distribution.store/",
                "status": 307
            },
            {
                "url": "https://projectp-distribution.store/",
                "status": 307
            },
            {
                "url": "http://projectp-distribution.store/",
                "status": 200
            }
        ],
        "dom_hash": "462d264146d288acdf5c12101e30c33d35c0762f8b793b29f32f3638830b114e",
        "doc_hash": "0146945be9749df7ee068fcadf494ed94ee33639ffed002f2f6fb8729b554c2c",
        "domain_risks": [
            "New Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "projectp-distribution.store",
                "type": "A",
                "value": "217.160.0.200"
            },
            {
                "name": "projectp-distribution.store",
                "type": "AAAA",
                "value": "2001:8d8:100f:f000::200"
            }
        ],
        "dnssec_valid": false,
        "ip": "217.160.0.200",
        "whois": {
            "registrar": "IONOS SE",
            "created": "2026-09-08T14:20:53Z",
            "updated": "2026-09-08T14:20:56Z",
            "expires": "2027-09-08T14:20:53Z",
            "nameservers": [
                "ns1017.ui-dns.com",
                "ns1047.ui-dns.org",
                "ns1066.ui-dns.de",
                "ns1056.ui-dns.biz"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T16:22:58Z",
        "analysis_at": "2026-10-10T15:37:59Z",
        "stats": {
            "timeout": 0,
            "harmless": 49,
            "malicious": 6,
            "suspicious": 3,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "G-Data": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "not recommended",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Unrated (alphaMountain.ai)"
        },
        "first_seen": "2026-09-10T14:08:51Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2001:8d8:100f:f000::200"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1066.ui-dns.de"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "217.160.0.200"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1047.ui-dns.org"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1017.ui-dns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1056.ui-dns.biz"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mx01.ionos.de",
                "priority": 10
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 include:_spf-eu.ionos.com ~all"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mx00.ionos.de",
                "priority": 10
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "hostmaster.1und1.com",
                "value": "ns1047.ui-dns.org"
            }
        ],
        "dns_at": "2026-10-10T15:52:56Z",
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "last changed": "2026-09-08T14:20:56Z",
                "registration": "2026-09-08T14:20:53Z",
                "registrar expiration": "2027-09-08T14:20:53Z",
                "last update of RDAP database": "2026-10-10T15:52:53Z"
            },
            "registrar": "IONOS SE",
            "registrar_iana_id": "83"
        }
    }
}
```