# PhishDestroy threat dossier — recruitmenttops.website ================================================================ Fetched: 2026-07-28 09:26:47 UTC Canonical: https://phishdestroy.io/domain/recruitmenttops.website/ ## VERDICT ---------------------------------------------------------------- ACTIVE THREAT — multiple warning signs Composite threat score: 45/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 ASN: ASAS13335 CLOUDFLARENET - Cloudflare, Inc., US Registrar: NameCheap, Inc. Nameservers: savanna.ns.cloudflare.com, vick.ns.cloudflare.com Registered: 2026-07-19 Expires: 2027-07-19 Page title: Профиль ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-19 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-28 09:22:02 UTC (by PhishDestroy tracker) First reported: 2026-07-28 07:29:45 UTC (abuse notice filed) Last verified: 2026-07-28 10:13:11 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019fa79c-13ab-731a-8a88-39ebdc8a1073/ URLQuery: https://urlquery.net/report/f9d88480-289b-4c92-a86b-8640a9908967 Wayback Machine: https://web.archive.org/web/*/recruitmenttops.website crt.sh CT logs: https://crt.sh/?q=%25.recruitmenttops.website Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=recruitmenttops.website AlienVault OTX: https://otx.alienvault.com/indicator/domain/recruitmenttops.website URLhaus: https://urlhaus.abuse.ch/host/recruitmenttops.website/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-28 09:22:25 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] recruitmenttops.website Safety Check — Phishing Blocklisted This report covers the domain recruitmenttops.website, which is currently classified as under investigation for generic phishing as of July 28, 2026. The domain was registered on July 19, 2026, via NAMECHEAP INC and remains active. DNS resolution points to IP address 188.114.97.3, with nameservers hosted by savanna.ns.cloudflare.com and vick.ns.cloudflare.com. At this time, the domain appears on a single security blocklist, specifically flagged by PhishDestroy for phishing-related concerns. This blocklisting indicates that at least one security vendor has identified suspicious or malicious activity associated with this domain, but further corroborating evidence from other sources is presently limited. VirusTotal intelligence indicates that 91 vendors have scanned the domain, with none currently flagging it. The absence of detections from these vendors does not guarantee the domain's safety, and defenders should not rely on this result as definitive. The exact content hosted on recruitmenttops.website has not yet been analyzed; there is no available information on site content, page titles, SSL configuration, or HTTP status. Given the combination of recent domain registration, its presence on a phishing blocklist, and the ongoing investigation, network defenders should proceed with caution. Security teams are advised to monitor for activity originating from this domain and consider implementing temporary blocks or enhanced monitoring until further intelligence is available. Continued observation of blocklists and external threat feeds is recommended to identify any changes in status or new evidence of malicious behavior. No specific brand targeting or scam category has been confirmed at this time. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260728-79721F ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/recruitmenttops.website/ JSON API: https://api.destroy.tools/v1/check?domain=recruitmenttops.website Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 210,385 domains (97,480 alive under monitoring, 111,874 confirmed takedowns/dead). Site: https://phishdestroy.io