# PhishDestroy domain threat record: rodeo-os.fly.dev Content language: English Canonical HTML report: https://phishdestroy.io/domain/rodeo-os.fly.dev/ Machine-readable companion: https://phishdestroy.io/domain/rodeo-os.fly.dev/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-11 09:51:43 UTC - Last availability or vendor check: 2026-10-23 22:17:25 UTC - Stored record updated: 2026-10-24 06:22:35 UTC - VirusTotal detections in the stored snapshot: 3/89 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 66.241.124.235 - Registrar in stored WHOIS data: Fly.io - Last stored HTTP status: 307 - Registration date (registry RDAP, fly.dev): 2019-03-01 16:38:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a08fb2-a18c-768b-95b5-bc97d08eb123/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/rodeo-os.fly.dev - Certificate Transparency search: https://crt.sh/?q=%25.rodeo-os.fly.dev - Web Archive lookup: https://web.archive.org/web/*/https://rodeo-os.fly.dev/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview rodeo-os.fly.dev is an impersonation phishing page that presents itself as "Rodeo OS — Rodeo Lending" and borrows the identity of a crypto lending product to win the trust of DeFi users. It sits on a free app-hosting subdomain rather than a domain the brand controls, which is a strong signal on its own. PhishDestroy first flagged it on 2026-09-11. As of 2026-10-19 the site is still online, and the address now redirects visitors elsewhere instead of serving its original page. How the scam works Lending impersonators copy the look of a real dashboard so a visitor believes they are opening a loan, supplying collateral or checking a position. The page then asks the user to connect a wallet and approve transactions or sign messages that appear routine. Those approvals can let the operator move tokens out of the wallet, so the victim loses the assets they meant to lend or use as collateral, and sometimes everything else the wallet held. Evidence Wallet-security lists back the classification. MetaMask and the SEAL community blocklist both include the domain alongside PhishDestroy, so many wallet users will see a warning before the page loads. Broader antivirus coverage is thin: on 2026-09-24, VirusTotal showed 3 of 89 engines flagging it (alphaMountain.ai, Forcepoint ThreatSeeker and VIPRE). A low engine count reflects how new and narrowly targeted the page is, and it does not mean the page is safe. Infrastructure The page runs as an app on Fly.io's shared platform, served from the Fly.io, Inc. network in the US. Because a deployment there takes minutes and needs no domain purchase, operators can launch, abandon and redeploy look-alike pages quickly. The redirect now active on this address fits that pattern of short-lived, easily swapped setups. What to do If you connected a wallet here, revoke every token approval and permission granted around that time using a trusted approval-management tool, and move remaining funds to a fresh wallet if you signed anything you did not fully understand. Never enter a seed phrase or private key on any lending site. Reach Rodeo's services only through links you have verified yourself, not through search ads or messages. Defenders should block the full hostname, watch for other look-alike lending apps on shared hosting subdomains, and report new variants to the hosting provider and wallet blocklists. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a08fb2-a18c-768b-95b5-bc97d08eb123/ VirusTotal report: https://www.virustotal.com/gui/domain/rodeo-os.fly.dev Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rodeo-os.fly.dev Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:44:22 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a08fb2-a18c-768b-95b5-bc97d08eb123.png Captured: 2026-09-12 08:12:09 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a08fb2-a18c-768b-95b5-bc97d08eb123.png Captured: 2026-09-12 08:12:09 UTC Source report: https://urlscan.io/result/01a08fb2-a18c-768b-95b5-bc97d08eb123/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/0015925b-50d6-41e1-a02c-458941cefe87.png Captured: 2026-09-11 09:55:47 UTC Source report: https://radar.cloudflare.com/scan/0015925b-50d6-41e1-a02c-458941cefe87 SHA-256: 767e9f351e75c5e3535af3bd98085fa5b0f9a98a230fce8172df57e14b635bc9 - URLScan · 2026-09-11: https://screenshots.phishdestroy.io/us/01a08fe6-4794-763a-85e7-089e4bfe951c.png Captured: 2026-09-11 09:57:14 UTC Source report: https://urlscan.io/result/01a08fe6-4794-763a-85e7-089e4bfe951c/ SHA-256: 90df12e97517ab92b69bdf2357a8b329b4752b49bc674e77a43407c273002b51 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T00:19:16Z", "uuid": "01a08fb2-a18c-768b-95b5-bc97d08eb123", "scanned_at": "2026-09-11T09:01:10Z", "final_url": "https://rodeo-os.fly.dev/login", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://rodeo-os.fly.dev/login", "from": "https://rodeo-os.fly.dev/", "status": 307 } ], "ip": "2a09:8280:1::189:be49:0", "ips": [ "2a09:8280:1::189:be49:0" ], "asns": [ "40509" ], "countries": [ "US" ], "doc_hash": "9023b5d6078486d036ff23e263b9f6202d946d682161fb6824bd5fef8af1e751", "script_hashes": [ "8a943b00599e56b53569f36f4341e3465ae7705c1391562cd6c7e1f290c0c387", "91f598badaed9141b1c267e346cdd724a023add2b14f3b6d5d8e7b280825c172", "c0930af826f989eea00dbaca15c1e4b3d3609b7b0bc5416a661a4948d8c26515", "be83f5498e4cc2221179a9c8a9dd4534a3b8703de9c5f9787a3e90c0f50253a6", "659b3689c11353d610754b5dd9d2925f2c74888591bf19ed82aec9a22aa13c0b", "34ed6abf4c6d0d1bb3dc56d3f133d2a5dbc3a3c89c791deab314e27143ac14ce", "e5f51abba3750b0a2ed43b81fb3ec47e19e7fd2aaf6ddf62c6236705f0bbbed4", "39de48b73a46ec02ed4ccd939c20e782025f99cb2a3eb82c39e8865951bfb1fa" ], "globals": [ "__next_f", "TURBOPACK", "next", "__webpack_hash__" ], "tls": { "san": [ "*.fly.dev" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "*.fly.dev", "protocol": "TLS 1.3", "valid_to": "2026-11-19T11:49:32Z", "valid_from": "2026-08-21T11:49:33Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 20, "tls_valid_days": 89, "requests": 15, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 95, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Fly/728d0e526 (2026-09-10)", "content-type": "text/html; charset=utf-8", "x-powered-by": "Next.js" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T02:32:02Z", "uuid": "0015925b-50d6-41e1-a02c-458941cefe87", "scanned_at": "2026-09-11T09:55:47Z", "final_url": "https://rodeo-os.fly.dev/login", "status": 200, "redirected": "same-domain", "history": [ { "url": "https://rodeo-os.fly.dev/", "status": 307 }, { "url": "https://rodeo-os.fly.dev/login", "status": 200 } ], "dom_hash": "55fc0618903bdbbd7c8ae2d537b58d153159899c9b5f2ac0bdea04423905e74a", "doc_hash": "9023b5d6078486d036ff23e263b9f6202d946d682161fb6824bd5fef8af1e751", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "rodeo-os.fly.dev", "type": "A", "value": "66.241.124.235" }, { "name": "rodeo-os.fly.dev", "type": "AAAA", "value": "2a09:8280:1::189:be49:0" } ], "dnssec_valid": false, "ip": "66.241.124.235", "whois": { "registrar": "Gandi SAS", "created": "2019-03-01T16:38:00Z", "updated": "2023-06-21T15:12:14Z", "expires": "2032-03-01T16:38:00Z", "nameservers": [ "ns1.flydns.net", "ns2.flydns.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T16:22:02Z", "analysis_at": "2026-09-24T02:00:13Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 3, "suspicious": 0, "undetected": 36 }, "detections": { "VIPRE": "malware", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Sophos": "information technology", "alphaMountain.ai": "Information Technology, Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds" }, "registrar": "Gandi SAS", "created": "2019-03-01T16:38:00Z", "expires": "2032-03-01T16:38:00Z", "updated": "2024-06-19T16:15:27Z", "first_seen": "2026-09-11T09:51:33Z", "dns": [ { "ttl": 300, "type": "A", "value": "66.241.124.235" }, { "ttl": 300, "type": "AAAA", "value": "2a09:8280:1::189:be49:0" } ], "dns_at": "2026-09-24T02:00:25Z", "jarm": "27d40d40d00000000042d43d00041d52bbed752033a2fd7c332cbbf6d72496", "cert": { "san": [ "*.fly.dev" ], "issuer": "Let's Encrypt / YE1", "serial": "688c4daf5300c51e0a5c1f6837a3a67a868", "sha256": "259a3b9cdaf4babbbe5eb781be238a521215df90afe8f515179930f2a6a859b4", "subject": "*.fly.dev", "valid_to": "2026-11-19T11:49:32Z", "valid_from": "2026-08-21T11:49:33Z" }, "whois": { "registrar": "Gandi SAS", "registrar_iana_id": "81", "registrar_url": "http://www.gandi.net", "created": "2019-03-01T16:38:00Z", "updated": "2024-06-19T16:15:27Z", "expires": "2032-03-01T16:38:00Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1.flydns.net", "ns2.flydns.net" ], "dnssec": "unsigned" } } } ```