# PhishDestroy threat dossier — security-governances.com ================================================================ Fetched: 2026-07-29 10:00:05 UTC Canonical: https://phishdestroy.io/domain/security-governances.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 12/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, BitDefender, Chong Lua Dao, CyRadar, ESET, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, SOCRadar, VIPRE AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 20.50.64.14 (IE, Dublin) ASN: AS8075 Microsoft Corporation Hosting org: Microsoft Azure App Service (northeurope) Registrar: Dynadot Inc Nameservers: ["ns1-32.azure-dns.com", "ns2-32.azure-dns.net"] Page title: Phishing Simulation Notice HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-10-12 Status: INVALID chain Fingerprint: ffb376f9055eaf056214346401f912c7c2d9369db213a530060b2b94633b3b2e ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-28 05:53:10 UTC (by PhishDestroy tracker) Last verified: 2026-07-29 09:34:08 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-28 05:54:11 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] security-governances.com: Confirmed Phishing Site The domain security-governances.com was observed returning HTTP 200, indicating the server is actively serving content. The domain is listed on a single security blocklist and has been explicitly blocked by PhishDestroy, confirming its classification as a malicious resource. VirusTotal analysis shows that 12 of 91 security vendors have flagged the domain as malicious, providing a multi‑vendor consensus that the site is being used for phishing. The domain is hosted on Azure DNS infrastructure, as indicated by its authoritative name servers ns1-32.azure-dns.com and ns2-32.azure-dns.net, and was registered through Dynadot Inc. The current status remains active, meaning the site is still reachable and potentially targeting victims. The detection count, blocklist presence, and third‑party blocking demonstrate a high confidence of phishing activity, aligning with the supplied threat type of generic phishing and the high risk rating. Uncertainty remains regarding the specific phishing campaign details, such as the targeted brand or the exact payload delivered, because no page title or content analysis is available in the provided intelligence. Defenders should add security-governances.com to deny‑list and URL filtering policies, enforce DNS sink‑hole or blocklist rules that include the domain, and monitor for any outbound connections to its Azure DNS name servers. Continuous re‑scanning on VirusTotal and other sandbox services is recommended to capture any evolution in the payload or additional vendor detections. Organizations employing email security gateways should treat any messages containing links to this domain as malicious and quarantine them. Incident response teams should collect any logs that reference the domain for forensic correlation and consider notifying the registrar Dynadot Inc. of the abusive use. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: ffb376f9055eaf056214346401f912c7c2d9369db213a530060b2b94633b3b2e ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/security-governances.com/ JSON API: https://api.destroy.tools/v1/check?domain=security-governances.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 194,582 domains (83,241 alive under monitoring, 108,559 confirmed takedowns/dead). Site: https://phishdestroy.io