# PhishDestroy threat dossier — shiruike.com ================================================================ Fetched: 2026-07-30 14:54:29 UTC Canonical: https://phishdestroy.io/domain/shiruike.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 7/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Ermes, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, Kaspersky, SOCRadar AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 198.252.106.36 (US, Los Angeles) ASN: AS20068 Hawk Host Inc. Hosting org: Hawk Host Inc Registrar: Gname 069 Inc Nameservers: dm1.longmingdns.com, dm2.longmingdns.com Registered: 2026-07-05 Expires: 2027-07-05 Page title: Cold wallet HTTP response: 302 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Asseco Data Systems S.A. / Certum DV TLS G2 R39 CA Expires: 2027-01-26 Status: INVALID chain Fingerprint: a27829f6dd079292832c3205d642a5617c42cf11f53c1a04c95aa91ed1354414 Subject Alternative Names (related infrastructure — often same operator): - www.shiruike.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-05 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-12 15:54:25 UTC (by PhishDestroy tracker) First reported: 2026-07-12 21:21:19 UTC (abuse notice filed) Last verified: 2026-07-30 16:20:35 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f569b-52b3-714f-8987-d449d0717e82/ URLQuery: https://urlquery.net/report/066821ca-f15a-4060-8a67-37c1849aaf38 Wayback Machine: https://web.archive.org/web/*/shiruike.com crt.sh CT logs: https://crt.sh/?q=%25.shiruike.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=shiruike.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/shiruike.com URLhaus: https://urlhaus.abuse.ch/host/shiruike.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-12 17:17:41 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] shiruike.com: Confirmed Phishing Site The domain shiruike.com was registered on July 05, 2026 through Gname 069 Inc. DNS resolution points to the single IPv4 address 198.252.106.36, which is hosted by Hawk Host Inc in the United States. No additional A records or CNAME entries were observed, indicating a dedicated pointing to the sole host. The site serves content over HTTPS using a certificate issued to Asseco Data Systems S.A., and the TLS handshake includes HSTS enforcement. Passive fingerprinting identified an Nginx front end delivering PHP scripts. Threat intelligence sources classify the domain as a high‑risk generic phishing operation. It is listed on three independent security blocklists and has been referenced in two AlienVault OTX pulses that describe credential‑harvesting pages mimicking popular login portals, although the exact landing page content has not been captured in this analysis. Real‑time filtering solutions such as PhishDestroy, MetaMask, and SEAL have already added shiruike.com to their deny lists. The authoritative name servers dm1.longmingdns.com and dm2.longmingdns.com are publicly resolvable and were observed during the investigation. Given the observed infrastructure and multiple blocklist references, the domain should be treated as an active phishing host. Defenders are advised to block inbound and outbound traffic to 198.252.106.36 and to add shiruike.com to local deny lists or firewall rules. Continuous monitoring of the associated name servers and of any new OTX pulses is recommended to capture potential re‑hosting or credential‑stealing activity. Network teams may also consider sinkholing the domain or redirecting requests to a safe landing page to gather telemetry on attempted connections. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260712-FE012F Favicon MD5: e0f1524ec1f315ea970f8c355a93716a TLS cert SHA-256: a27829f6dd079292832c3205d642a5617c42cf11f53c1a04c95aa91ed1354414 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/shiruike.com/ JSON API: https://api.destroy.tools/v1/check?domain=shiruike.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,918 domains (83,616 alive under monitoring, 110,042 confirmed takedowns/dead). Site: https://phishdestroy.io