# PhishDestroy threat dossier — rightresponsenow6.com ================================================================ Fetched: 2026-06-30 11:22:56 UTC Canonical: https://phishdestroy.io/domain/rightresponsenow6.com/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 75/100 (PhishDestroy scoring — see methodology below) Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 1/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.67.209.214 (US, Columbus) ASN: ASAS13335 CLOUDFLARENET - Cloudflare, Inc., US Hosting org: AS16509 Amazon.com, Inc. Registrar: Hosting Concepts B.V. d/b/a Registrar.eu Nameservers: ns1.dnsimple-edge.com, ns1.dnsimple.com, ns2.dnsimple-edge.net, ns3.dnsimple-edge.io, ns3.dnsimple.com, ns4.dnsimple-edge.org Registered: 2026-06-26 Expires: 2027-06-26 Page title: RightResponse AI | Review & Reputation Software HTTP response: 403 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-26 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-27 02:25:07 UTC (by PhishDestroy tracker) First reported: 2026-06-27 00:31:46 UTC (abuse notice filed) Last verified: 2026-06-30 12:20:35 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f0675-ec2c-726f-8cf5-70927122f348/ URLQuery: https://urlquery.net/report/9e041a76-f877-4bf3-8326-21d2e09d7be7 Wayback Machine: https://web.archive.org/web/*/rightresponsenow6.com crt.sh CT logs: https://crt.sh/?q=%25.rightresponsenow6.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=rightresponsenow6.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/rightresponsenow6.com URLhaus: https://urlhaus.abuse.ch/host/rightresponsenow6.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-27 02:58:04 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, rightresponsenow6.com, is flagged under the threat classification generic_phishing with an active status and risk level currently under investigation. The site presents itself as RightResponse AI, a review and reputation management software platform, using the page title 'RightResponse AI | Review & Reputation Software.' No specific drainer kit or known phishing framework has been conclusively linked to this domain at this time, though the impersonation of a legitimate SaaS product suggests credential harvesting or fraudulent subscription enrollment as likely objectives. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 3.131.150.69, registered through Hosting Concepts B.V. d/b/a Registrar.eu on June 26, 2026. The SSL certificate is issued by Let's Encrypt, providing HTTPS encryption. VirusTotal reports 0 detections out of 95 engines, indicating no current antivirus or URL scanner flags. However, AlienVault OTX lists the domain in one threat intelligence pulse, suggesting prior identification in a malicious context. Google Safe Browsing status is not provided, and no blocklist count is available from public feeds at this time. Current status remains active, with no takedown or sinkholing observed. Response actions include monitoring for credential submission patterns, analyzing hosted content for phishing templates, and tracking DNS changes. Despite the 0/95 VirusTotal score, the domain's future-dated creation (2026), impersonation of a legitimate business tool, and presence in a threat intelligence pulse elevate the risk profile. Users are advised to block access to 3.131.150.69 and rightresponsenow6.com at the network perimeter, verify SSL certificates independently, and inspect any inbound links for social engineering cues. [Updates since narrative was generated:] - Public blocklists: now listed on 1 feed ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260627-CB20D0 Favicon MD5: 1e52d491b606dabab5c95eb3ba4d9413 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/rightresponsenow6.com/ JSON API: https://api.destroy.tools/v1/check?domain=rightresponsenow6.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 172,677 domains (12,746 alive under monitoring, 159,341 confirmed takedowns/dead). Site: https://phishdestroy.io