# PhishDestroy threat dossier — restore-iedgeriive.su ================================================================ Fetched: 2026-07-04 02:18:40 UTC Canonical: https://phishdestroy.io/domain/restore-iedgeriive.su/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Ledger ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/92 security vendors flagged this domain Flagging vendors: Gridinsoft, Kaspersky Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 213.111.149.25 (UA, Kyiv) ASN: AS6698 Virtual Systems LLC Hosting org: Vsys Ua Uc Ssd Vps Registrar: RUCENTER-SU Nameservers: ns01.serverspace.io, ns01.serverspace.io., ns02.serverspace.io, ns02.serverspace.io. Registered: 2026-05-08 Page title: Welcome ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-08-03 Status: INVALID chain Fingerprint: cd4bceeb1e05e9af00e6356e31049c541b7d28de8d85c9f2891d372788b31131 Subject Alternative Names (related infrastructure — often same operator): - www.restore-iedgeriive.su ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-08 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-08 11:06:57 UTC (by PhishDestroy tracker) First reported: 2026-05-08 08:07:54 UTC (abuse notice filed) Last verified: 2026-07-04 00:20:35 UTC Neutralised: 2026-06-06 17:31:38 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e069e-3e52-751d-8ada-90155d12a456/ URLQuery: https://urlquery.net/report/9b5bc441-83f9-4693-91c8-bf4788c77930 Wayback Machine: https://web.archive.org/web/*/restore-iedgeriive.su crt.sh CT logs: https://crt.sh/?q=%25.restore-iedgeriive.su Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=restore-iedgeriive.su AlienVault OTX: https://otx.alienvault.com/indicator/domain/restore-iedgeriive.su URLhaus: https://urlhaus.abuse.ch/host/restore-iedgeriive.su/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-08 11:07:33 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies the domain restore-iedgeriive.su as a live phishing page impersonating the official Ledger wallet recovery portal. The site is currently active and masquerades as a legitimate service to trick users into surrendering their recovery phrases or private keys. This campaign targets cryptocurrency holders who may be seeking to restore access to their wallets, making it a high-risk threat to personal digital assets and financial security. This domain was flagged by 2 of 95 VirusTotal vendors and already appears on 2 public blocklists. It was registered on May 05, 2026 through RUCENTER-SU, resolving to IP address 213.111.149.25. The site uses a Let’s Encrypt SSL certificate to appear trustworthy, yet it is blocked by MetaMask and SEAL security systems, indicating early-stage detection by reputable security vendors. Given the active status and evasive characteristics of restore-iedgeriive.su, PhishDestroy recommends users avoid interacting with this domain and immediately report it to their browser or wallet security extensions. Cryptocurrency users should verify URLs through official Ledger channels before entering any sensitive information. Organizations are advised to add this domain to internal blocklists and monitor for related campaigns. Seed: 276cd5 ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260508-15639D TLS cert SHA-256: cd4bceeb1e05e9af00e6356e31049c541b7d28de8d85c9f2891d372788b31131 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/restore-iedgeriive.su/ JSON API: https://api.destroy.tools/v1/check?domain=restore-iedgeriive.su Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 174,417 domains (12,388 alive under monitoring, 161,211 confirmed takedowns/dead). Site: https://phishdestroy.io