# PhishDestroy domain threat record: redacts.fun

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/redacts.fun/
Machine-readable companion: https://phishdestroy.io/domain/redacts.fun/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 21:50:13 UTC
- Last availability or vendor check: 2026-10-27 21:50:13 UTC
- Stored record updated: 2026-10-27 23:45:04 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: ledger

## Stored infrastructure

- Observed IP address: 23.94.5.138
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Registrar country in stored WHOIS data: HK
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-23 13:48:55 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17f56-229a-74db-9747-6a206a094236/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/redacts.fun
- Certificate Transparency search: https://crt.sh/?q=%25.redacts.fun
- Web Archive lookup: https://web.archive.org/web/*/https://redacts.fun/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added redacts.fun to its internal blocklist on 2026-10-27 after an admin report highlighted the newly registered domain. The prior AI assessment on the same day could not determine malicious or clean content, and the page returned an HTTP 200 response with the recorded title “Redact — Hold NVDA. Privately.”.

How the scam works
No specific phishing, credential‑harvesting, or wallet‑draining mechanism was observed on the page. The listing reflects a general risk associated with freshly created domains that imitate financial services, but no concrete scam flow can be confirmed from the available evidence.

Evidence
VirusTotal scanned the domain on 2026-10-25 and reported zero detections out of 92 engines. Google Safe Browsing checked the URL on 2026-10-28 and did not flag it. urlscan.io captured the site on 2026-10-27; its engine analysis marked it malicious with a score of 95, while the overall verdict was non‑malicious. OTX listed four pulses mentioning redacts.fun as of 2026-10-28. PhishDestroy’s internal blocklist marked the domain as present, and external blocklists returned no hits on the check date.

Infrastructure
The domain was registered on 2026-10-23 through NICENIC INTERNATIONAL GROUP CO., LIMITED and used the nameservers ns3.my-ndns.com and ns4.my-ndns.com. The recorded IP was 23.94.5.138, belonging to HostPapa in the United States, and the site presented a Let’s Encrypt TLS 1.3 certificate valid until 2027-01-21.

What to do
Visitors should avoid submitting credentials, private keys, or payment information to the site; if any were entered, change the credentials immediately and monitor accounts for unusual activity. Defenders can block redacts.fun at the network perimeter and review logs for connections to 23.94.5.138.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17f56-229a-74db-9747-6a206a094236/
Cloudflare Radar report: https://radar.cloudflare.com/scan/7a0e9d6e-e2be-48b4-a1fa-b2f1d730107c
URLQuery report: https://urlquery.net/report/04b4d5c1-b74f-4faf-bf40-4ededce1ee8e
Stored capture screenshot: https://i.ibb.co/3YswpXsH/d957b676dde6.png
Cloudflare Radar screenshot (2026-10-27T22:21:26Z): https://screenshots.phishdestroy.io/cf/7a0e9d6e-e2be-48b4-a1fa-b2f1d730107c.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/04b4d5c1-b74f-4faf-bf40-4ededce1ee8e.png
VirusTotal report: https://www.virustotal.com/gui/domain/redacts.fun
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=redacts.fun
Archived copy: https://web.archive.org/web/20261027215123/https://redacts.fun/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 23:23:54 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/3YswpXsH/d957b676dde6.png
  Captured: 2026-10-27 21:50:13 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a17f56-229a-74db-9747-6a206a094236.png
  Captured: 2026-10-27 21:50:13 UTC
  Source report: https://urlscan.io/result/01a17f56-229a-74db-9747-6a206a094236/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7a0e9d6e-e2be-48b4-a1fa-b2f1d730107c.png
  Captured: 2026-10-27 22:21:26 UTC
  Source report: https://radar.cloudflare.com/scan/7a0e9d6e-e2be-48b4-a1fa-b2f1d730107c
  SHA-256: 504ed81d533ca1e0822582a7d0142eb340356a4eceedb617259d7d056b267e61
- URLQuery: https://screenshots.phishdestroy.io/uq/04b4d5c1-b74f-4faf-bf40-4ededce1ee8e.png
  Source report: https://urlquery.net/report/04b4d5c1-b74f-4faf-bf40-4ededce1ee8e
  SHA-256: 4b2e1103cd55f02cb6eb2bf15707dbb4fe62eed5f80b35f03b0002d49d1c055e

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T22:23:45Z",
        "uuid": "01a17f56-229a-74db-9747-6a206a094236",
        "scanned_at": "2026-10-27T21:48:44Z",
        "final_url": "https://redacts.fun/",
        "status": 200,
        "ip": "23.94.5.138",
        "ptr": "23-94-5-138-host.colocrossing.com",
        "domains": [
            "admin.nulltraces.top"
        ],
        "ips": [
            "23.94.5.138"
        ],
        "asns": [
            "36352"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "robinhoodchain.blockscout.com",
            "gmgn.ai",
            "x.com"
        ],
        "social": [
            "https://x.com/redactrobinhood"
        ],
        "doc_hash": "777e52f8339bed6b9af35cd79351cdf33bd27b0defaff72660d165e11eaead25",
        "script_hashes": [
            "26c0fb7b800049cd227ec893f2ca945f8e6b9778510d7a4e509a60f85161f971",
            "98dfcf9a04a90ce9a7a8283e8fa503803141cd4d41352a90cb4b2e5338a4fd70",
            "ea1e49f479914f8a72dc31ac1a65f4a3e84280d81ec372858fb6c42546b9cf09",
            "00965e04947873dfd0b9a0f7eb0a0e78821ca6907ae17096562d097acad580e9",
            "8834c374491f42bfc05a18e91ccf6f3ecc26da07da27ee7abdb4c6ca6af6232e",
            "b10855b298b1bdc54a0d114ea8addee1bafb0bee44bd8b68f4cbaf2e5014a829",
            "0793180a4720935b6b49cc1217c5d89a6e072d34d6ffe532d3a71fdaba858091"
        ],
        "globals": [
            "__next_f",
            "webpackChunk_N_E",
            "next",
            "_N_E_STYLE_LOAD"
        ],
        "tls": {
            "san": [
                "redacts.fun"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "redacts.fun",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-21T17:34:39Z",
            "valid_from": "2026-10-23T17:34:40Z"
        },
        "domain_age_days": 2,
        "apex_age_days": 2,
        "tls_age_days": 4,
        "tls_valid_days": 89,
        "requests": 17,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains",
            "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; img-src 'self' data: https://admin.nulltraces.top; font-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T22:23:48Z",
        "uuid": "7a0e9d6e-e2be-48b4-a1fa-b2f1d730107c",
        "scanned_at": "2026-10-27T22:21:26Z",
        "final_url": "https://redacts.fun/",
        "status": 200,
        "history": [
            {
                "url": "https://redacts.fun/",
                "status": 200
            }
        ],
        "dom_hash": "c8c0f7fb1189dfdb56a681269fd3f0686df0c0a1d223d3671be92e262160d2ed",
        "doc_hash": "777e52f8339bed6b9af35cd79351cdf33bd27b0defaff72660d165e11eaead25",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "redacts.fun",
                "type": "A",
                "value": "23.94.5.138"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.15",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-23T15:48:55Z",
            "updated": "2026-10-23T15:48:55Z",
            "expires": "2027-10-23T15:48:55Z",
            "nameservers": [
                "ns3.my-ndns.com",
                "ns4.my-ndns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T23:23:02Z",
        "analysis_at": "2026-10-25T22:18:47Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-10-23T15:48:55Z",
        "expires": "2027-10-23T15:48:55Z",
        "updated": "2026-10-23T15:48:55Z",
        "first_seen": "2026-10-23T18:38:31Z",
        "dns": [
            {
                "ttl": 7200,
                "type": "NS",
                "value": "ns4.my-ndns.com"
            },
            {
                "ttl": 7200,
                "type": "A",
                "value": "23.94.5.138"
            },
            {
                "ttl": 7200,
                "type": "SOA",
                "rname": "root.redacts.fun",
                "value": "redacts.fun"
            },
            {
                "ttl": 7200,
                "type": "NS",
                "value": "ns3.my-ndns.com"
            }
        ],
        "dns_at": "2026-10-25T22:27:29Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "redacts.fun"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "64a5ddc08899e23da96b46a2b7257542eaa",
            "sha256": "809cb5ff0e8942ce695232d8bf936e6976eccbf6e68d2e63be2b2a025f2210e3",
            "subject": "redacts.fun",
            "valid_to": "2027-01-21T17:34:39Z",
            "valid_from": "2026-10-23T17:34:40Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-10-22T16:00:00Z",
            "updated": "2026-10-22T16:00:00Z",
            "expires": "2027-10-22T16:00:00Z",
            "status": [
                "addPeriod",
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns3.my-ndns.com",
                "ns4.my-ndns.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-22T16:00:00Z",
                "registration": "2026-10-22T16:00:00Z",
                "registrar expiration": "2027-10-22T16:00:00Z",
                "last update of RDAP database": "2026-10-22T16:00:00Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T21:54:45Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "redacts.fun"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-27T21:51:23Z",
            "first": "2026-10-27T21:51:23Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 7668
        },
        "robots_txt": {
            "present": true,
            "sitemaps": [
                "https://redacts.fun/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 4
        },
        "social_tags": {
            "ogUrl": "https://redacts.fun",
            "title": "Redact — Hold NVDA. Privately.",
            "ogType": "website",
            "ogImage": "https://redacts.fun/opengraph-image",
            "ogTitle": "Redact — Hold NVDA. Privately.",
            "ogSiteName": "Redact",
            "description": "Confidential payments and private positions on Robinhood Chain. A shielded pool, stealth addresses, and gasless relayers for USDG and Stock Tokens.",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://redacts.fun",
            "ogDescription": "Confidential payments and private positions on Robinhood Chain. A shielded pool, stealth addresses, and gasless relayers for USDG and Stock Tokens."
        },
        "trackers": {
            "requests": 14
        },
        "mixed_content": {
            "upgrade_insecure": true,
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 189,
                "tls": 154,
                "wait": 105,
                "connect": 101,
                "download": 112
            },
            "response_ms": 661
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 32150,
            "co2_grams": 0.0012,
            "cleaner_than": 46
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "43.162.114.218",
                    "host": "ns4.my-ndns.com"
                },
                {
                    "ip": "154.85.54.43",
                    "host": "ns3.my-ndns.com"
                }
            ],
            "zone": "redacts.fun"
        },
        "location": {
            "ip": "23.94.5.138",
            "asn": "36352",
            "org": "HostPapa",
            "city": "Buffalo",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "redacts.fun"
        },
        "dns": {
            "A": [
                "23.94.5.138"
            ],
            "NS": [
                "ns4.my-ndns.com",
                "ns3.my-ndns.com"
            ],
            "SOA": "{\"nsname\": \"redacts.fun\", \"hostmaster\": \"root.redacts.fun\", \"serial\": 2026102300, \"refresh\": 7200, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 7200}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000; includeSubDomains",
            "message": "HSTS header does not contain the preload directive."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; img-src 'self' data: https://admin.nullt",
            "strictTransportPolicy": "max-age=31536000; includeSubDomains",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "23.94.5.138",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://redacts.fun"
            ]
        },
        "linked_pages": {
            "external": [
                "https://gmgn.ai/robinhood/token/0xd3a3212f4dec57120cee5cb5b7e4d7d0f5f6e681",
                "https://robinhoodchain.blockscout.com/address/0xd3a3212f4dec57120cee5cb5b7e4d7d0f5f6e681",
                "https://x.com/redactrobinhood"
            ],
            "external_count": 3,
            "internal_count": 3
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-23T15:48:55Z",
            "updated": "2026-10-23T15:48:55Z",
            "expires": "2027-10-23T15:48:55Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "clientDeleteProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "ns3.my-ndns.com",
                "ns4.my-ndns.com"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=31536000; includeSubDomains",
                "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; img-src 'self' data: https://admin.nulltraces.top; font-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; connect-src 'self'; form-action 'self'; upgrade-insecure-requests",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin",
                "permissions-policy": "camera=(), microphone=(), geolocation=()"
            }
        }
    }
}
```