# PhishDestroy threat dossier — prostitutkikrasnoyarskauno.info ================================================================ Fetched: 2026-04-27 04:47:08 UTC Canonical: https://phishdestroy.io/domain/prostitutkikrasnoyarskauno.info/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 54/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/94 security vendors flagged this domain Flagging vendors: SOCRadar ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 80.79.4.168 (NL, Naaldwijk) ASN: AS49981 WorldStream B.V. Hosting org: Worldstream Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED !!! REGISTRAR INTEGRITY ALERT — NiceNIC !!! NiceNIC International: over 90% of its registered domains are associated with illegal content; documented systematic abuse-report non-response. Primary sources: https://phishdestroy.io/nicenic-real https://phishdestroy.io/nicenic-verdict Nameservers: ["ns1.servak10.top", "ns2.servak10.top"] Registered: 2026-04-14 Expires: 2027-04-11 Page title: Проститутки Красноярска - заказать индивидуалку на сайте | Снять шлюх в Красноярске ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-07-11 Status: INVALID chain Fingerprint: 1b41019e9b66760099f669cb74a0181006d299d592d9e3662f969dc22ddd3071 Subject Alternative Names (related infrastructure — often same operator): - www.prostitutkikrasnoyarskauno.info ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-14 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-14 19:44:22 UTC (by PhishDestroy tracker) Last verified: 2026-04-23 01:28:00 UTC Neutralised: 2026-04-23 00:27:55 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d8cdd-e821-721d-93d5-08ab5cf9269f/ Wayback Machine: https://web.archive.org/web/*/prostitutkikrasnoyarskauno.info crt.sh CT logs: https://crt.sh/?q=%25.prostitutkikrasnoyarskauno.info Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=prostitutkikrasnoyarskauno.info AlienVault OTX: https://otx.alienvault.com/indicator/domain/prostitutkikrasnoyarskauno.info URLhaus: https://urlhaus.abuse.ch/host/prostitutkikrasnoyarskauno.info/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-14 19:45:18 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies prostitutkikrasnoyarskauno.info as an active phishing domain engaged specifically in credential harvesting attacks. There is no direct association with known brand impersonation or use of a recognized drainer kit at this time. The domain appears to target user credentials under the broader generic phishing classification, warranting close monitoring due to the sensitive nature of the data being targeted. Technical indicators reveal that the domain resolves to IP address 80.79.4.168 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain was created recently on April 11, 2026. VirusTotal analysis shows a 0 out of 95 detection ratio, indicating it has not yet been flagged by major antivirus engines. The domain utilizes a Let's Encrypt SSL certificate, adding a level of HTTPS encryption that can deceptively increase the trustworthiness perceived by victims. There is no Google Safe Browsing blocklist status or other public blocklist entries noted so far. Currently, prostitutkikrasnoyarskauno.info remains active and under investigation for this specific credential harvesting threat. Given the absence of detections on VirusTotal and blocklist entries, it poses a latent risk to users who may be tricked into submitting sensitive login information. Immediate response actions include ongoing traffic monitoring, user education to avoid interaction with the domain, and alerting hosting or registrar entities to potential abuse. Users and organizations should block access to this domain proactively until further clearance is obtained, as the risk of credential compromise remains significant despite the domain’s low detection footprint. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 57e1b9dcd37b51a39de6bbffcb13d85f TLS cert SHA-256: 1b41019e9b66760099f669cb74a0181006d299d592d9e3662f969dc22ddd3071 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/prostitutkikrasnoyarskauno.info/ JSON API: https://api.destroy.tools/v1/check?domain=prostitutkikrasnoyarskauno.info Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io