# PhishDestroy domain threat record: sbigold.cc Content language: English Canonical HTML report: https://phishdestroy.io/domain/sbigold.cc/ Machine-readable companion: https://phishdestroy.io/domain/sbigold.cc/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-26 16:21:00 UTC - Last availability or vendor check: 2026-10-26 16:42:09 UTC - Stored record updated: 2026-10-26 19:33:40 UTC - VirusTotal detections in the stored snapshot: 2/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: sui ## Stored infrastructure - Observed IP address: 104.21.42.9 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-08-17 11:35:05 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17916-0b6c-731a-86de-c482ab26545e/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/sbigold.cc - Certificate Transparency search: https://crt.sh/?q=%25.sbigold.cc - Web Archive lookup: https://web.archive.org/web/*/https://sbigold.cc/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed sbigold.cc on 2026-10-26 after automated analysis flagged it as suspicious. The recorded page title on that date was "SBI", which does not itself prove malicious intent. An HTTP 200 response was recorded on 2026-10-26, showing the site responded at the time of observation. How the scam works The multi‑source detections are typical of phishing or crypto‑related scams that impersonate trusted brands to lure credentials or wallet approvals. No specific malicious behavior was observed on the captured page, so the exact technique cannot be confirmed. Evidence URLScan scanned the domain on 2026-10-25 and returned a malicious verdict, labeling it as phishing and a cryptoscam. VirusTotal reported two detections on 2026-10-26: one malicious (Forcepoint ThreatSeeker) and one suspicious (alphaMountain.ai) out of 92 engines. Google Safe Browsing checked the URL on 2026-10-26 and did not flag it. OTX listed four pulses mentioning the domain, and PhishDestroy’s internal blocklist marked it as malicious on 2026-10-26 while external blocklists showed no entries. Infrastructure The domain was registered with Dynadot Inc on 2026-08-17 and was 69 days old at the time of analysis. Hosting was observed through Cloudflare, with recorded IP addresses 172.67.198.25 and 104.21.42.9, and the site presented a TLS 1.3 certificate issued by Google Trust Services that was valid until 2027-01-13. DNS records included A, AAAA and NS entries, ports 80, 443 and 8080 were observed as open, and DNSSEC was not enabled. What to do Visitors should avoid entering any credentials or approving wallet connections on sbigold.cc and, if they have already done so, change passwords and monitor associated accounts for unauthorized activity. Security teams can block the domain at the network perimeter, add it to threat‑intel feeds, and review logs for connections to the recorded IP addresses. Monitoring was recommended because the presence of malicious detections does not guarantee the site remained active or that it had already compromised users. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a17916-0b6c-731a-86de-c482ab26545e/ Cloudflare Radar report: https://radar.cloudflare.com/scan/dca759ef-b605-40bb-96d4-7973b31c71ff URLQuery report: https://urlquery.net/report/6fe73c52-7a51-4387-88bc-f04242692995 Stored capture screenshot: https://i.ibb.co/nsNyMLBX/e76123cf03a0.png Cloudflare Radar screenshot (2026-10-26T16:29:50Z): https://screenshots.phishdestroy.io/cf/dca759ef-b605-40bb-96d4-7973b31c71ff.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/6fe73c52-7a51-4387-88bc-f04242692995.png URLScan screenshot (2026-10-25T20:34:53Z): https://screenshots.phishdestroy.io/us/01a174c5-a1ff-7278-ba0c-427f1a43fa74.png URLScan capture report: https://urlscan.io/result/01a174c5-a1ff-7278-ba0c-427f1a43fa74/ URLScan screenshot (2026-10-26T16:49:21Z): https://screenshots.phishdestroy.io/us/01a1791d-9f70-742b-a401-ff1c17bf75a4.png URLScan capture report: https://urlscan.io/result/01a1791d-9f70-742b-a401-ff1c17bf75a4/ VirusTotal report: https://www.virustotal.com/gui/domain/sbigold.cc Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=sbigold.cc Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 19:02:15 UTC ## Stored page captures - Primary capture: https://i.ibb.co/nsNyMLBX/e76123cf03a0.png Captured: 2026-10-26 16:42:09 UTC - URLScan capture 1: https://urlscan.io/screenshots/01a17916-0b6c-731a-86de-c482ab26545e.png Captured: 2026-10-26 16:42:09 UTC Source report: https://urlscan.io/result/01a17916-0b6c-731a-86de-c482ab26545e/ - URLScan capture 2: https://screenshots.phishdestroy.io/01a174c5-a1ff-7278-ba0c-427f1a43fa74.png Captured: 2026-10-26 16:21:00 UTC Source report: https://urlscan.io/result/01a17916-0b6c-731a-86de-c482ab26545e/ - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1791d-9f70-742b-a401-ff1c17bf75a4.png Captured: 2026-10-26 16:49:21 UTC Source report: https://urlscan.io/result/01a1791d-9f70-742b-a401-ff1c17bf75a4/ SHA-256: aa1b35d7ea6ecf9dcecff7c08ce2a2067751f5004cf855e3c8bd4368433d6446 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/dca759ef-b605-40bb-96d4-7973b31c71ff.png Captured: 2026-10-26 16:29:50 UTC Source report: https://radar.cloudflare.com/scan/dca759ef-b605-40bb-96d4-7973b31c71ff SHA-256: af93e3649d02068116adf2dc745ec8b7b0784772f356bb9bf8dbc164e1c5f421 - URLQuery: https://screenshots.phishdestroy.io/uq/6fe73c52-7a51-4387-88bc-f04242692995.png Source report: https://urlquery.net/report/6fe73c52-7a51-4387-88bc-f04242692995 SHA-256: 7cbd3346816f5ad2776f0cbb25937ba54f6ca1ff7eda2bbd430516f5275bfcfa - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a174c5-a1ff-7278-ba0c-427f1a43fa74.png Captured: 2026-10-25 20:34:53 UTC Source report: https://urlscan.io/result/01a174c5-a1ff-7278-ba0c-427f1a43fa74/ SHA-256: 48a9ebc6bb99386801297d85c4fea5e95497ac1c60092fd74ce2994f734b4e2b ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T17:04:21Z", "uuid": "01a17916-0b6c-731a-86de-c482ab26545e", "scanned_at": "2026-10-26T16:41:04Z", "final_url": "https://sbigold.cc/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://sbigold.cc/", "from": "http://sbigold.cc/", "status": 307 } ], "ip": "172.67.198.25", "domains": [ "api.sbigold.cc", "bin.bnbstatic.com", "plugin-code.salesmartly.com", "newbasset.s3.dualstack.ap-east-1.amazonaws.com", "newbasset.s3.ap-east-1.amazonaws.com", "msg.salesmartly.com", "neweasset.s3.ap-southeast-1.amazonaws.com", "srz.salesmartly.com", "widget.salesmartly.com", "client.salesmartly.com", "unpkg.com", "api.salesmartly.com", "mix-ads.oss-accelerate.aliyuncs.com" ], "ips": [ "104.18.22.242", "47.254.187.140", "104.18.23.242", "108.138.7.80", "18.245.31.86", "3.5.214.150", "3.5.239.24", "18.245.46.20", "3.5.215.6", "3.5.151.224", "104.21.42.9", "104.18.0.22", "172.67.198.25" ], "asns": [ "13335", "45102", "16509" ], "countries": [ "DE", "US", "HK", "SG" ], "doc_hash": "18ccf609338d09b4cea97d209962c8f5d31d63c01328aa7cdfcfa2365551d523", "script_hashes": [ "b560abee96cea6274a84460c61016941151ae1fd8c9f9f117333cdd2532f69c7", "a44efc9b6633a0f3a25f9c17e9f118fa9c71b4a175f5e4d55243cf61dbc8131b", "b72ba794c6fcaa6cba1f97f8909a431b44791be0866072290c0fe288fd1bb619", "cb6d9f15536b6b7a81bb2f55d076c2a2a2ff43e14375e3897e454a9c8137a4fd" ], "globals": [ "regeneratorRuntime", "VConsole", "TradingView", "addMeta", "__VUE_INSTANCE_SETTERS__", "__VUE_SSR_SETTERS__", "__config", "__INTLIFY_PROD_DEVTOOLS__", "__INTLIFY_JIT_COMPILATION__", "__INTLIFY_DROP_MESSAGE_COMPILER__", "__VUE_I18N_FULL_INSTALL__", "__VUE_I18N_LEGACY_API__", "PubSub", "setImmediate", "clearImmediate", "_Highcharts", "__theme", "apiready", "__VUE__", "__ssc", "ssq", "__read", "__spreadArray", "__SS_CHAT_RUNTIME__", "__SS_CHAT_SCRIPT_MODE__", "SHOPINFO", "ASSETS_HOSTNAME_VARIABLE", "ASSETS_CDN_HOSTNAME_VARIABLE", "STATIC_HOSTNAME_VARIABLE", "__SS_CHAT_SHADOWROOT__", "ssmEvent", "saveAs", "marked", "__SS_MARKED_CONFIGURED__" ], "cookies": [ "ss_uid", "_ss_s_uid" ], "storage_keys": [ "wallet_page_id", "SBI_THEME", "setting", "salesmartly_p_g1x3ofj_session_tab_key", "salesmartly_p_g1x3ofj_u_i", "salesmartly_p_g1x3ofj_custom_fields_local_map", "salesmartly_p_g1x3ofj_p_xma_", "salesmartly_p_g1x3ofj_g_uid", "salesmartly_p_g1x3ofj_token_date", "salesmartly_p_g1x3ofj_token", "ss_p_c_l_v_pro", "salesmartly_p_g1x3ofj_n_u" ], "tls": { "san": [ "sbigold.cc", "*.sbigold.cc" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "sbigold.cc", "protocol": "TLS 1.3", "valid_to": "2027-01-13T15:18:45Z", "valid_from": "2026-10-15T14:20:06Z" }, "domain_age_days": 69, "apex_age_days": 69, "tls_age_days": 11, "tls_valid_days": 90, "requests": 125, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "cryptoscam" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Crypto Scam" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T16:33:13Z", "uuid": "dca759ef-b605-40bb-96d4-7973b31c71ff", "scanned_at": "2026-10-26T16:29:50Z", "final_url": "https://sbigold.cc/", "status": 200, "history": [ { "url": "https://sbigold.cc/", "status": 200 } ], "dom_hash": "2a16014d87a382bb5d1b897c6a3e2ca4e9ca2b720ae59048f5587f3146f96009", "doc_hash": "edf7b3bdbf21c605bf0dc63138e8e0e0c591122870cf4e535f3166d3fe7bef00", "phishing_v2": [ "phishing" ], "url_risks": [ "Scam" ], "domain_risks": [ "Scam", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "api.sbigold.cc", "type": "A", "value": "104.21.42.9" }, { "name": "api.sbigold.cc", "type": "A", "value": "172.67.198.25" }, { "name": "api.sbigold.cc", "type": "AAAA", "value": "2606:4700:3032::ac43:c619" }, { "name": "api.sbigold.cc", "type": "AAAA", "value": "2606:4700:3030::6815:2a09" }, { "name": "sbigold.cc", "type": "A", "value": "172.67.198.25" }, { "name": "sbigold.cc", "type": "A", "value": "104.21.42.9" }, { "name": "sbigold.cc", "type": "AAAA", "value": "2606:4700:3030::6815:2a09" }, { "name": "sbigold.cc", "type": "AAAA", "value": "2606:4700:3032::ac43:c619" } ], "dnssec_valid": false, "ip": "172.67.198.25", "whois": { "registrar": "Dynadot Inc", "created": "2026-08-17T13:35:05Z", "updated": "2026-08-17T13:39:44Z", "expires": "2027-08-17T13:35:05Z", "nameservers": [ "amy.ns.cloudflare.com", "cleo.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T19:01:37Z", "analysis_at": "2026-10-26T17:08:51Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 1, "suspicious": 1, "undetected": 37 }, "detections": { "alphaMountain.ai": "suspicious", "Forcepoint ThreatSeeker": "malicious" }, "reputation": 0, "registrar": "Dynadot Inc", "created": "2026-08-17T13:35:05Z", "expires": "2027-08-17T13:35:05Z", "updated": "2026-08-17T13:39:44Z", "first_seen": "2026-08-17T15:50:38Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "cleo.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.198.25" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "amy.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::6815:2a09" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::ac43:c619" }, { "ttl": 300, "type": "A", "value": "104.21.42.9" }, { "ttl": 21600, "type": "NS", "value": "amy.ns.cloudflare.com" } ], "dns_at": "2026-10-26T17:14:10Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "sbigold.cc", "*.sbigold.cc" ], "issuer": "Google Trust Services / WE1", "serial": "c7caf58fea4cbbdc13f4c2050029f6a7", "sha256": "bb24b63fcf750e41f903bcda811d967c978b83c2158559699c43c4ae8da5e748", "subject": "sbigold.cc", "valid_to": "2027-01-13T15:18:45Z", "valid_from": "2026-10-15T14:20:06Z" }, "whois": { "registrar": "Dynadot Inc", "registrar_iana_id": "472", "registrar_url": "http://www.dynadot.com", "created": "2026-08-17T13:35:05Z", "updated": "2026-08-17T13:39:44Z", "expires": "2027-08-17T13:35:05Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "amy.ns.cloudflare.com", "cleo.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-08-17T13:35:05Z", "last changed": "2026-08-17T13:39:45Z", "registration": "2026-08-17T13:35:05Z", "registrar expiration": "2027-08-17T13:35:05Z", "last update of RDAP database": "2026-10-26T12:43:16Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T16:34:07Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "sbigold.cc" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-26T16:32:35Z", "first": "2026-10-26T16:32:35Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 2653 }, "social_tags": { "title": "SBI", "robots": "index, nofollow", "ogImage": "/platform/sbi/logo_144.png?1790234657970", "ogTitle": "SBI", "keywords": "SBI", "themeColor": "#ffffff", "description": "SBI", "ogDescription": "SBI" }, "trackers": { "requests": 99, "trackers": [ { "name": "Amazon Web Services", "company": "Amazon", "country": "US", "category": "Hosting", "requests": 27 }, { "name": "unpkg", "company": "unpkg", "category": "Hosting", "requests": 2 } ] }, "mixed_content": { "no_sri": [ "https://unpkg.com/vconsole@latest/dist/vconsole.min.js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 12, "tls": 34, "wait": 461, "connect": 6, "download": 0 }, "response_ms": 513 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 3761, "co2_grams": 0.0001, "cleaner_than": 93 }, "dns_server": { "ns": [ { "ip": "173.245.58.101", "host": "amy.ns.cloudflare.com" }, { "ip": "108.162.193.89", "host": "cleo.ns.cloudflare.com" } ], "zone": "sbigold.cc" }, "location": { "ip": "2606:4700:3032::ac43:c619", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "sbigold.cc" }, "dns": { "A": [ "172.67.198.25", "104.21.42.9" ], "NS": [ "cleo.ns.cloudflare.com", "amy.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"amy.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417764385, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3030::6815:2a09", "2606:4700:3032::ac43:c619" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3032::ac43:c619", "family": 6 }, "redirects": { "chain": [ "https://sbigold.cc" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2026-08-17T13:35:05Z", "updated": "2026-08-17T13:39:44Z", "expires": "2027-08-17T13:35:05Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "amy.ns.cloudflare.com", "cleo.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html" } } } } ```