# PhishDestroy threat dossier — serveousercontent.com ================================================================ Fetched: 2026-07-28 09:30:49 UTC Canonical: https://phishdestroy.io/domain/serveousercontent.com/ ## VERDICT ---------------------------------------------------------------- HIGH THREAT — malicious activity confirmed Composite threat score: 71/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 15/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, ESET, Fortinet, G-Data, Gridinsoft, Lionic, Lumu, SOCRadar, URLQuery, VIPRE, Webroot AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 5.255.123.12 (NL, Dronten) ASN: AS60404 The Infrastructure Group B.V. Hosting org: TIG Registrar: Key-Systems GmbH Nameservers: ["ns1.digitalocean.com", "ns2.digitalocean.com", "ns3.digitalocean.com"] Page title: Expose local servers to the internet | Serveo HTTP response: 302 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2 Expires: 2026-08-02 Status: INVALID chain Fingerprint: 1bd7662a1e466b21601770b90abf15fb1a3102cd3b60bea9c81c54a97498e448 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-28 05:33:09 UTC (by PhishDestroy tracker) Last verified: 2026-07-28 08:30:49 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-28 05:34:35 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] serveousercontent.com Generic Phishing Alert The domain serveousercontent.com is currently classified as a high‑risk generic phishing site and remains active as of the report date, July 28, 2026. Infrastructure analysis shows the domain is hosted on DigitalOcean infrastructure, as indicated by its authoritative nameservers ns1.digitalocean.com, ns2.digitalocean.com, and ns3.digitalocean.com. Registration data reveals the domain was provisioned through the registrar Key-Systems GmbH, a detail that aligns with other malicious actors that leverage reputable registrars to obscure attribution. HTTP probing returned a 302 redirect response, a technique commonly employed to forward victims to credential‑harvesting pages while evading simple static URL checks. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing its malicious reputation. VirusTotal scans have recorded 15 of 91 security vendors flagging the domain, demonstrating a moderate consensus among detection engines that the site is associated with phishing activity. No additional contextual data such as page title, brand impersonation, or SSL certificate details are available at this time. Defenders should prioritize immediate containment by adding serveousercontent.com to deny lists across perimeter firewalls, secure web gateways, and DNS filtering solutions. Continuous monitoring of outbound traffic for connections to the domain’s IP ranges is advised, as is the enrichment of existing threat‑intel feeds with the observed blocklist and vendor detection counts. Organizations should also consider issuing user‑awareness alerts that reference the domain name, emphasizing that any unsolicited communications directing users to serveousercontent.com are likely malicious. Ongoing investigation should focus on capturing any payloads or redirection chains observed during live traffic analysis to further clarify the phishing campaign’s objectives and potential victim profile. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 1bd7662a1e466b21601770b90abf15fb1a3102cd3b60bea9c81c54a97498e448 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/serveousercontent.com/ JSON API: https://api.destroy.tools/v1/check?domain=serveousercontent.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 210,385 domains (97,480 alive under monitoring, 111,874 confirmed takedowns/dead). Site: https://phishdestroy.io