# PhishDestroy domain threat record: sdfuussuuppq3487kkk.top

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/sdfuussuuppq3487kkk.top/
Machine-readable companion: https://phishdestroy.io/domain/sdfuussuuppq3487kkk.top/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 16:48:17 UTC
- Last availability or vendor check: 2026-10-26 16:48:17 UTC
- Stored record updated: 2026-10-26 19:33:42 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: flagged

## Stored infrastructure

- Observed IP address: 206.119.182.22
- Registrar in stored WHOIS data: Gname.com Pte. Ltd.
- Registrar country in stored WHOIS data: CN
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-23 01:21:28 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1791b-7e89-7529-bb26-342f8726503d/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/sdfuussuuppq3487kkk.top
- Certificate Transparency search: https://crt.sh/?q=%25.sdfuussuuppq3487kkk.top
- Web Archive lookup: https://web.archive.org/web/*/https://sdfuussuuppq3487kkk.top/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot on 2026-10-26 shows a crypto exchange homepage branded BIIGO, with navigation for Buy Crypto, Trade, IEO and Staking, a rocket graphic, an email field labelled Please enter email account and a Register button, banners offering referral rewards, a 200 USDT bonus and DeFi staking, and a BTC/USDT and ETH/USDT price table with Trade buttons. PhishDestroy classified it a Fake Exchange by automated assessment, and it was first seen on 2026-10-26.

How the scam works
The page pairs an email signup field with a headline 24 hour trading volume of $289,789,518.011, referral rewards of $1M plus an extra $100K, a 200 USDT bonus and DeFi staking up to 100% APY. That reward-heavy funnel is a typical credential-harvesting pattern for a fake exchange posing as BIIGO, drawing people toward deposits on an unverified platform. No wallet interaction was observed in the capture.

Evidence
The screenshot showed the BIIGO branding, email field and bonus banners as observed on 2026-10-26. On that date the urlscan ML engine scored it malicious at 89 while urlscan's overall verdict remained not malicious, Cloudflare Radar judged it malicious with phishing and DGA categories, Google Safe Browsing flagged SOCIAL_ENGINEERING, and OTX recorded 3 pulses. VirusTotal did not flag the domain, external blocklists recorded 0 entries while PhishDestroy's internal blocklist listed it, and a 307 redirect from HTTP to HTTPS led to the captured page. Site inspection recorded 56 requests, Google Fonts and jsDelivr trackers, no recognized JS framework in urlscan's globals beyond runner and canvas symbols, and two page hashes kept for pivoting, the first twelve hex of one being 4c2a963e621a.

Infrastructure
Notable weaknesses: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP all absent, HSTS present but not covering subdomains, SPF, DKIM and DMARC absent, DNSSEC unsigned, CAA present; TLS 1.3, AES-256-GCM, forward secrecy, ALPN h2. The domain was registered on 2026-10-23 through Gname.com Pte. Ltd., hosting recorded on a network labelled SonderCloud Limited, with no WAF or CDN identified in the recorded signals.

What to do
If you entered an email address on sdfuussuuppq3487kkk.top, treat any follow-up messages as untrusted and do not send funds; if you reused that password on a genuine exchange, change it there and enable 2FA. Security teams should block sdfuussuuppq3487kkk.top, watch for lookalike domains and share the indicators.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1791b-7e89-7529-bb26-342f8726503d/
Cloudflare Radar report: https://radar.cloudflare.com/scan/47c95ab3-e13b-4c4a-8a05-2c9e626712bd
URLQuery report: https://urlquery.net/report/6a4cc482-93b7-41b8-af3d-78407769379c
Stored capture screenshot: https://i.ibb.co/v4mK1BLP/612901f6d71d.png
Cloudflare Radar screenshot (2026-10-26T17:22:30Z): https://screenshots.phishdestroy.io/cf/47c95ab3-e13b-4c4a-8a05-2c9e626712bd.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/6a4cc482-93b7-41b8-af3d-78407769379c.png
VirusTotal report: https://www.virustotal.com/gui/domain/sdfuussuuppq3487kkk.top
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=sdfuussuuppq3487kkk.top
Archived copy: https://web.archive.org/web/20261026164957/https://sdfuussuuppq3487kkk.top/
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 18:18:03 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/v4mK1BLP/612901f6d71d.png
  Captured: 2026-10-26 16:48:17 UTC
- URLScan capture: https://urlscan.io/screenshots/01a1791b-7e89-7529-bb26-342f8726503d.png
  Captured: 2026-10-26 16:48:17 UTC
  Source report: https://urlscan.io/result/01a1791b-7e89-7529-bb26-342f8726503d/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/47c95ab3-e13b-4c4a-8a05-2c9e626712bd.png
  Captured: 2026-10-26 17:22:30 UTC
  Source report: https://radar.cloudflare.com/scan/47c95ab3-e13b-4c4a-8a05-2c9e626712bd
  SHA-256: 87dcc5194335193f1a91b4eaf44a9dd9598e95d7c95c75a7ffd698fd22765e70
- URLQuery: https://screenshots.phishdestroy.io/uq/6a4cc482-93b7-41b8-af3d-78407769379c.png
  Source report: https://urlquery.net/report/6a4cc482-93b7-41b8-af3d-78407769379c
  SHA-256: 7d41fb57391ede08d8ba4a67b6dcdcf1ea72c568ff8e65426099f47eabb1a999

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T17:23:13Z",
        "uuid": "01a1791b-7e89-7529-bb26-342f8726503d",
        "scanned_at": "2026-10-26T16:46:53Z",
        "final_url": "https://sdfuussuuppq3487kkk.top/",
        "status": 444,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://sdfuussuuppq3487kkk.top/",
                "from": "http://sdfuussuuppq3487kkk.top/",
                "status": 307
            }
        ],
        "ip": "206.119.182.22",
        "ips": [
            "206.119.182.22"
        ],
        "asns": [
            "133199"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "globals": [
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass",
            "reloadButtonClick",
            "downloadButtonClick",
            "detailsButtonClick",
            "setAutoFetchState"
        ],
        "tls": {
            "san": [
                "sdfuussuuppq3487kkk.top",
                "www.sdfuussuuppq3487kkk.top"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "sdfuussuuppq3487kkk.top",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-21T02:53:55Z",
            "valid_from": "2026-10-23T02:53:56Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 3,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 89,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T17:23:15Z",
        "uuid": "47c95ab3-e13b-4c4a-8a05-2c9e626712bd",
        "scanned_at": "2026-10-26T17:22:30Z",
        "final_url": "https://sdfuussuuppq3487kkk.top/",
        "status": 200,
        "history": [
            {
                "url": "https://sdfuussuuppq3487kkk.top/",
                "status": 200
            }
        ],
        "dom_hash": "4c2a963e621a057aaf97a4b7d75f7d8980522707b4aa24af139b482d17684afe",
        "doc_hash": "1aa1cc034aa5554c5d67e47e488350feb6fc99281514ced375dbe0ee2cc7fc5e",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "New Domains",
            "Security Risks",
            "Newly Seen Domains",
            "DGA Domains",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "sdfuussuuppq3487kkk.top",
                "type": "A",
                "value": "206.119.182.22"
            }
        ],
        "dnssec_valid": false,
        "ip": "206.119.182.22",
        "verdict": {
            "tags": [
                "dga domains"
            ],
            "malicious": true,
            "categories": [
                "dga domains"
            ]
        },
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "created": "2026-10-23T03:21:28Z",
            "updated": "2026-10-23T03:21:32Z",
            "expires": "2027-10-23T03:21:28Z",
            "nameservers": [
                "a11.share-dns.com.",
                "b11.share-dns.net."
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T17:21:51Z",
        "analysis_at": "2026-10-26T15:38:27Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Gname.com Pte. Ltd.",
        "created": "2026-10-23T03:21:28Z",
        "expires": "2027-10-23T03:21:28Z",
        "updated": "2026-10-23T03:21:32Z",
        "first_seen": "2026-10-23T03:58:20Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "b.share-dns.net"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "206.119.182.22"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "master.share-dns.com",
                "value": "a.share-dns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "a.share-dns.com"
            }
        ],
        "dns_at": "2026-10-26T15:40:53Z",
        "jarm": "3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763",
        "cert": {
            "san": [
                "sdfuussuuppq3487kkk.top",
                "www.sdfuussuuppq3487kkk.top"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "52069f3f9ad92102edc1db6ff40c5d7ce65",
            "sha256": "2deea234908e320520fb99bd141ae5b7f0a17104ceeb61a82ae1f7a6750f58b7",
            "subject": "sdfuussuuppq3487kkk.top",
            "valid_to": "2027-01-21T02:53:55Z",
            "valid_from": "2026-10-23T02:53:56Z"
        },
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "registrar_iana_id": "1923",
            "registrar_url": "http://www.gname.com",
            "created": "2026-10-23T03:21:28Z",
            "updated": "2026-10-23T03:21:32Z",
            "expires": "2027-10-23T03:21:28Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "a11.share-dns.com",
                "b11.share-dns.net"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-23T03:21:28Z",
                "registration": "2026-10-23T03:21:28Z",
                "last update of RDAP database": "2026-10-23T03:21:33Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:51:11Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "sdfuussuuppq3487kkk.top"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T16:49:57Z",
            "first": "2026-10-26T16:49:57Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 21289
        },
        "trackers": {
            "requests": 56,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 4
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://cdn.staticfile.org/jquery/1.10.2/jquery.min.js",
                "https://cdn.staticfile.org/jquery/2.1.1/jquery.min.js"
            ],
            "third_party_scripts": 2
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 152,
                "tls": 279,
                "wait": 593,
                "connect": 273,
                "download": 528
            },
            "response_ms": 1825
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 100152,
            "co2_grams": 0.0037,
            "cleaner_than": 22
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.53.25",
                    "host": "a.share-dns.com"
                },
                {
                    "ip": "162.159.27.88",
                    "host": "b.share-dns.net"
                }
            ],
            "zone": "sdfuussuuppq3487kkk.top"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "PHPSESSID",
                    "session": true
                }
            ]
        },
        "location": {
            "ip": "206.119.182.22",
            "asn": "133199",
            "org": "Cogent Communications",
            "city": "Los Angeles",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "sdfuussuuppq3487kkk.top"
        },
        "dns": {
            "A": [
                "206.119.182.22"
            ],
            "NS": [
                "b.share-dns.net",
                "a.share-dns.com"
            ],
            "SOA": "{\"nsname\": \"a.share-dns.com\", \"hostmaster\": \"master.share-dns.com\", \"serial\": 1792726225, \"refresh\": 3600, \"retry\": 1200, \"expire\": 86400, \"minttl\": 600}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "206.119.182.22",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://sdfuussuuppq3487kkk.top"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.simplex.com/account/buy",
                "https://banxa.com/"
            ],
            "external_count": 2,
            "internal_count": 27
        },
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "created": "2026-10-23T03:21:28Z",
            "updated": "2026-10-23T03:21:32Z",
            "expires": "2027-10-23T03:21:28Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "a11.share-dns.com",
                "b11.share-dns.net"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html; charset=utf-8",
                "x-powered-by": "ThinkPHP",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```