# sh6345906.d.had.su — MALICIOUS

> sh6345906.d.had.su is linked to medium-risk phishing attacks. Learn how this domain operates and how to protect yourself from fraud attempts.

## Summary
PhishDestroy identifies sh6345906.d.had.su as an active phishing domain posing a medium-level threat to internet users. Phishing attacks lure victims into revealing sensitive information such as login credentials, financial data, or personal details, potentially leading to identity theft or financial loss. Vigilance against such domains remains crucial to maintain online security and privacy.

This domain was created on May 10, 2017, and is registered through ARDIS-SU. It resolves to the IP address 81.91.178.193. VirusTotal analysis shows 5 out of 95 security vendors flag this domain for suspicious activity, indicating a credible phishing risk. The domain’s longevity combined with its registration under a known registrar associated with questionable activity suggests a well-established infrastructure used to facilitate phishing campaigns.

Users should avoid interacting with sh6345906.d.had.su, especially refraining from entering any personal or financial information on web pages associated with this domain. Employing updated antivirus software and enabling browser phishing filters can help detect and block suspicious sites. Reporting suspicious emails or links directing to this domain to security teams or platforms like PhishDestroy can also aid in mitigating the impact of such phishing threats.

## Threat Details
- Verdict: MALICIOUS
- Site status: alive (HTTP 200)
- Page title: sh6345906.d.had.su

## Domain Intelligence
- Registered: 2026-03-05 13:07:01
- Registrar: ARDIS-SU
- IP: 81.91.178.193
- Nameservers: ns1.zomro.net. ns2.zomro.ru. ns3.zomro.com. ns4.zomro.su.

## Detection Status
- VirusTotal: 8 vendors flagged
  Vendors: ["CRDF", "CyRadar", "ESET", "Google Safebrowsing", "Gridinsoft", "MalwareURL", "Seclookup", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://i.ibb.co/XrcZvK2N/41b1dafdf612.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/b8a9d599-9789-4c2e-8d62-28e7b50c042f
- PhishDestroy: https://phishdestroy.io/domain/sh6345906.d.had.su/

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/sh6345906.d.had.su/
Last updated: 2026-03-14