# PhishDestroy threat dossier — siteimproveanalytic.net ================================================================ Fetched: 2026-06-26 16:16:24 UTC Canonical: https://phishdestroy.io/domain/siteimproveanalytic.net/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Google Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: bot_redirect_safe) (score: 4/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 19/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, Certego, Chong Lua Dao, CyRadar, ESET, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, MalwareURL, Sansec eComscan, Seclookup, SOCRadar, Sophos, Sucuri SiteCheck, Webroot AlienVault OTX: 8 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 142.251.156.119 (NL, Lelystad) ASN: ASAS15169 GOOGLE - Google LLC, US Hosting org: AS49453 Global Layer B.V. Registrar: OwnRegistrar, Inc. Nameservers: bjorn.ns.cloudflare.com, null, riya.ns.cloudflare.com Registered: 2023-09-12 Expires: 2026-09-12 Page title: Google ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-09-15 Status: INVALID chain Fingerprint: 8face7e6d7614776fc1d07b502fc3e6f1e963102739b3c9afae3232c6058b56f Subject Alternative Names (related infrastructure — often same operator): - www.siteimproveanalytic.net ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2023-09-12 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-23 00:25:02 UTC (by PhishDestroy tracker) First reported: 2026-06-22 23:32:24 UTC (abuse notice filed) Last verified: 2026-06-26 16:20:36 UTC Neutralised: 2026-06-23 06:17:55 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019ef16e-7e43-7165-b059-53a54c3b3e9e/ URLQuery: https://urlquery.net/report/19dcd8e7-02fb-4957-8d0a-0471e7c52629 Wayback Machine: https://web.archive.org/web/*/siteimproveanalytic.net crt.sh CT logs: https://crt.sh/?q=%25.siteimproveanalytic.net Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=siteimproveanalytic.net AlienVault OTX: https://otx.alienvault.com/indicator/domain/siteimproveanalytic.net URLhaus: https://urlhaus.abuse.ch/host/siteimproveanalytic.net/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-23 09:52:25 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, siteimproveanalytic.net, impersonates the Google brand by displaying a page titled "Google." The primary threat is phishing, as the site likely attempts to harvest user credentials or personal information by mimicking a trusted login or service page. Cloaking behavior (bot_redirect_safe) indicates the site serves benign content to security scanners while potentially redirecting real users to malicious pages. Technical analysis reveals 19 out of 95 VirusTotal vendors flagged the domain as malicious. It was registered on 2023-09-12 via OwnRegistrar, Inc. and is hosted on IP 142.251.156.119 (AS49453 Global Layer B.V., Netherlands). The SSL certificate is issued by Let's Encrypt (YR2), and nameservers are bjorn.ns.cloudflare.com and riya.ns.cloudflare.com. The domain is currently offline, but its creation date and detection history suggest active abuse. The domain risk score is 98, indicating a high likelihood of malicious intent. Despite being offline, the site poses a significant threat due to brand impersonation and cloaking techniques. Users should avoid interacting with this domain and report it to relevant blocklists. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260622-CE9D7F Favicon MD5: f3418a443e7d841097c714d69ec4bcb8 TLS cert SHA-256: 8face7e6d7614776fc1d07b502fc3e6f1e963102739b3c9afae3232c6058b56f ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/siteimproveanalytic.net/ JSON API: https://api.destroy.tools/v1/check?domain=siteimproveanalytic.net Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 170,544 domains (12,571 alive under monitoring, 157,589 confirmed takedowns/dead). Site: https://phishdestroy.io