# PhishDestroy domain threat record: pusatws.id Content language: English Canonical HTML report: https://phishdestroy.io/domain/pusatws.id/ Machine-readable companion: https://phishdestroy.io/domain/pusatws.id/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-03 12:18:15 UTC - Last availability or vendor check: 2026-10-21 01:13:53 UTC - Stored record updated: 2026-10-22 14:23:52 UTC - VirusTotal detections in the stored snapshot: 6/90 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Blast ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: PT Jagoan Hosting Indonesia - Registrar country in stored WHOIS data: Unknown - Registration date (registry RDAP, pusatws.id): 2026-07-22 14:58:19 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a06732-c2df-7137-af86-b228ea2e1dae/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/pusatws.id - Certificate Transparency search: https://crt.sh/?q=%25.pusatws.id - Web Archive lookup: https://web.archive.org/web/*/https://pusatws.id/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview pusatws.id is an impersonation phishing page that presented itself as "PUSATWS - Blast Platform" and borrowed the Blast name to look like an official service. It targets people who use or are curious about Blast and could mistake a branded portal for the real thing. PhishDestroy first flagged it on 2026-09-03. The site has been offline since 2026-09-11, and when we last checked on 2026-10-19 its DNS was still inactive. How the scam works Impersonation pages like this copy the name and styling of a trusted platform so the visitor drops their guard. The title "PUSATWS - Blast Platform" frames the site as an official Blast portal. Pages of this kind typically ask the visitor to sign in, enter account details or connect a crypto wallet, and anything submitted goes to the operators rather than to Blast. Depending on what was handed over, victims can lose account access, personal data or funds controlled by the connected wallet. Evidence Six of 90 VirusTotal engines flagged the domain as of 2026-09-06: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and VIPRE. That is a modest count, which is common for short-lived phishing domains caught early, but these are six independent vendors reaching the same verdict. The domain also appears in four AlienVault OTX threat pulses. PhishDestroy lists it on its blocklist. Infrastructure The domain was registered on 2026-07-22 through PT Jagoan Hosting Indonesia, about six weeks before we detected it. Its address resolved to Cloudflare, Inc. infrastructure geolocated in Canada. That address belongs to Cloudflare's proxy network and does not reveal where the actual server sat. The site went dark only about a week after detection, a lifespan typical of disposable phishing domains. What to do If you entered a password on pusatws.id, change it on the real Blast service and anywhere else you reuse it, then turn on two-factor authentication. If you connected a wallet or signed anything there, review and revoke the token approvals you granted. Move any remaining funds to a fresh wallet if you typed in a seed phrase. Defenders should block the domain and check DNS and proxy logs for visits since 2026-07-22. They should also warn users that Blast-branded portals on unfamiliar domains are not official. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a06732-c2df-7137-af86-b228ea2e1dae/ VirusTotal report: https://www.virustotal.com/gui/domain/pusatws.id Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=pusatws.id Archived copy: https://web.archive.org/web/20260903122439/https://pusatws.id/login Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 11:01:34 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a06732-c2df-7137-af86-b228ea2e1dae.png Captured: 2026-09-03 12:18:15 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a06732-c2df-7137-af86-b228ea2e1dae.png Captured: 2026-09-03 12:18:15 UTC Source report: https://urlscan.io/result/01a06732-c2df-7137-af86-b228ea2e1dae/ - URLQuery: https://screenshots.phishdestroy.io/uq/9adf4437-6798-4214-9f06-56edf228792f.png Captured: 2026-09-03 12:19:13 UTC Source report: https://urlquery.net/report/9adf4437-6798-4214-9f06-56edf228792f SHA-256: 9a9d784ad50df8e657a543b1195bff091426c5520e8d2b8b056516532a0f5ec9 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/fefbedea-0e5d-4d2f-80fb-092136502685.png Captured: 2026-09-03 12:20:03 UTC Source report: https://radar.cloudflare.com/scan/fefbedea-0e5d-4d2f-80fb-092136502685 SHA-256: b0181c0e94cd571d10b9ed15744da353710c91ece947a5297cd023d8a88a06ef - URLScan ยท 2026-09-03: https://screenshots.phishdestroy.io/us/01a06737-60a5-77a7-96d7-ada19647ac03.png Captured: 2026-09-03 12:21:29 UTC Source report: https://urlscan.io/result/01a06737-60a5-77a7-96d7-ada19647ac03/ SHA-256: c6af024b97fabb45199780ee05902fe3e94c2f0483538acb7ce3ade4b95535af ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:53:19Z", "uuid": "01a06732-c2df-7137-af86-b228ea2e1dae", "scanned_at": "2026-09-03T12:16:27Z", "final_url": "https://pusatws.id/login", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://pusatws.id/", "from": "http://pusatws.id/", "status": 307 }, { "to": "https://pusatws.id/login", "from": "https://pusatws.id/", "status": 307 } ], "ip": "104.21.55.82", "domains": [ "challenges.cloudflare.com", "static.cloudflareinsights.com" ], "ips": [ "104.18.95.41", "104.16.79.73", "104.21.55.82" ], "asns": [ "13335" ], "doc_hash": "2d85c3a8dd6d175088cfd942fcf8c8cd7aa7ee2e251245faa1d6cbaed351dd6b", "script_hashes": [ "2493f8c663e9e72e38b0836962e5b0ccadbcb9f7205c4436441e2536f323fcac", "5261101892e2476e4346e19e86fd5f19cbcf7c765ff76e92eb9cefcc86b6db6a", "d3648d33d9b06994e5a2fb25db41dee5725f00e8b618c2edcf3dfd7344d66e02", "99ee2ec21d7a29359b32cd6350fe05b7281b238567adf9067aa9bc257537d480", "4aa4c1b550d504bd3dcbc89880b4ccb059a1e4ab242865c9744f2779f017a8ce", "039bc48fa27a0fc1c532f10092b1726bf77a6f42d163318d819fe12efe6e4cc0", "de789666938784241e5c51fb45ce37ee568495a7b7c5a7adf89d8526a68804e1", "5d6068c85e5a64bd5a4a09fced6a8579b88f5c5aa0406c0fa673ea5478ee7606", "e054e286cac9ed2b9ccd2db1c92f7523612f38de00f131341cdcba8593023244" ], "globals": [ "TURBOPACK", "__next_f", "__cfBeacon", "next", "__webpack_hash__", "turnstile" ], "tls": { "san": [ "pusatws.id", "*.pusatws.id" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "pusatws.id", "protocol": "QUIC", "valid_to": "2026-10-24T07:58:24Z", "valid_from": "2026-07-26T07:02:25Z" }, "domain_age_days": 39, "apex_age_days": 39, "tls_age_days": 39, "tls_valid_days": 90, "requests": 23, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-powered-by": "Next.js", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:34:03Z", "uuid": "fefbedea-0e5d-4d2f-80fb-092136502685", "scanned_at": "2026-09-03T12:20:03Z", "final_url": "https://pusatws.id/login", "status": 200, "redirected": "https-only", "history": [ { "url": "http://pusatws.id/", "status": 307 }, { "url": "https://pusatws.id/", "status": 307 }, { "url": "https://pusatws.id/login", "status": 200 } ], "dom_hash": "4e558d6185bfd38dd8b5b2df91efbfa903ab90ec59ba617cd5872e7d888ed127", "doc_hash": "2d85c3a8dd6d175088cfd942fcf8c8cd7aa7ee2e251245faa1d6cbaed351dd6b", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "pusatws.id", "type": "A", "value": "188.114.97.0" }, { "name": "pusatws.id", "type": "A", "value": "188.114.96.0" }, { "name": "pusatws.id", "type": "AAAA", "value": "2a06:98c1:3121::" }, { "name": "pusatws.id", "type": "AAAA", "value": "2a06:98c1:3120::" } ], "dnssec_valid": false, "ip": "188.114.97.0", "whois": { "registrar": "PT Jagoan Hosting Indonesia", "created": "2026-07-22T14:58:19Z", "updated": "2026-07-26T07:58:02Z", "expires": "2027-07-22T23:59:59Z", "nameservers": [ "aitana.ns.cloudflare.com", "jack.ns.cloudflare.com" ] } } } ```