# PhishDestroy domain threat record: sitemvhxgcydip4z.cfd

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/sitemvhxgcydip4z.cfd/
Machine-readable companion: https://phishdestroy.io/domain/sitemvhxgcydip4z.cfd/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-21 15:29:42 UTC
- Stored record updated: 2026-10-21 16:00:09 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.68.209
- Registrar in stored WHOIS data: Spaceship, Inc.
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a15de1-2d11-756f-bc0e-91ca89607e4a/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/sitemvhxgcydip4z.cfd
- Certificate Transparency search: https://crt.sh/?q=%25.sitemvhxgcydip4z.cfd
- Web Archive lookup: https://web.archive.org/web/*/https://sitemvhxgcydip4z.cfd/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added sitemvhxgcydip4z.cfd to its internal blocklist on 2026-10-21 after an admin report. The recorded page title is “Archway” and the HTTP response was 200 at the time of capture. The prior AI assessment noted insufficient page content to determine a concrete threat.

How the scam works
The listing does not confirm a specific scam technique because no malicious functionality was observed. Domains flagged as suspicious are sometimes used for phishing, credential harvesting, or other fraud, but the current evidence does not demonstrate such behavior on this site.

Evidence
VirusTotal scanned the domain on 2026-10-21 with 92 engines and reported 0 malicious or suspicious detections. Google Safe Browsing checked on the same date and returned no flag. URLScan captured the site on 2026-10-21; its machine‑learning engine assigned a malicious score of 81, while the overall verdict was clean. Cloudflare Radar on 2026-10-21 labeled the domain as phishing and as a DGA domain. External blocklists MetaMask and SEAL listed the domain on 2026-10-21, and OTX showed 0 pulses on that date.

Infrastructure
The domain was registered on 2026-10-21 through Spaceship, Inc. It was observed to resolve to Cloudflare IP addresses 104.21.68.209 and 172.67.198.121 and to use a Let's Encrypt certificate valid until 2027-01-19. DNSSEC was not enabled.

What to do
Visitors should avoid entering credentials or wallet information; if any were submitted, change passwords immediately. Organizations should block the domain at firewalls or proxies and review logs for connections to the recorded IPs. No specific wallet remediation is required unless approvals were knowingly granted.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a15de1-2d11-756f-bc0e-91ca89607e4a/
Cloudflare Radar report: https://radar.cloudflare.com/scan/da749f45-9826-42a6-ad90-5eb1f64a8291
Stored capture screenshot: https://urlscan.io/screenshots/01a15de1-2d11-756f-bc0e-91ca89607e4a.png
Cloudflare Radar screenshot (2026-10-21T15:40:58Z): https://screenshots.phishdestroy.io/cf/da749f45-9826-42a6-ad90-5eb1f64a8291.png
URLScan screenshot (2026-10-21T15:35:02Z): https://screenshots.phishdestroy.io/us/01a15f19-b219-77b6-ac63-cfcbb3f40cbc.png
URLScan capture report: https://urlscan.io/result/01a15f19-b219-77b6-ac63-cfcbb3f40cbc/
URLScan screenshot (2026-10-21T15:41:01Z): https://screenshots.phishdestroy.io/us/01a15f1e-ffb2-74d8-bbed-6ccca8b96e1b.png
URLScan capture report: https://urlscan.io/result/01a15f1e-ffb2-74d8-bbed-6ccca8b96e1b/
URLScan screenshot (2026-10-21T15:41:48Z): https://screenshots.phishdestroy.io/us/01a15f20-19c1-75da-914e-2ed6138a6c9f.png
URLScan capture report: https://urlscan.io/result/01a15f20-19c1-75da-914e-2ed6138a6c9f/
VirusTotal report: https://www.virustotal.com/gui/domain/sitemvhxgcydip4z.cfd
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=sitemvhxgcydip4z.cfd
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-21 15:46:57 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a15de1-2d11-756f-bc0e-91ca89607e4a.png
  Captured: 2026-10-21 15:29:42 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/da749f45-9826-42a6-ad90-5eb1f64a8291.png
  Captured: 2026-10-21 15:40:58 UTC
  Source report: https://radar.cloudflare.com/scan/da749f45-9826-42a6-ad90-5eb1f64a8291
  SHA-256: 89457e322e6e392148f73d83ce2656af6b767cc36242ee99664d1661d2e144a9
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15f19-b219-77b6-ac63-cfcbb3f40cbc.png
  Captured: 2026-10-21 15:35:02 UTC
  Source report: https://urlscan.io/result/01a15f19-b219-77b6-ac63-cfcbb3f40cbc/
  SHA-256: f88b8677a4dc82ec42e44a5137a586eaf080cd500d9ee0c8ac3e0cdb7ecbaaee
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15f1e-ffb2-74d8-bbed-6ccca8b96e1b.png
  Captured: 2026-10-21 15:41:01 UTC
  Source report: https://urlscan.io/result/01a15f1e-ffb2-74d8-bbed-6ccca8b96e1b/
  SHA-256: ae67578b3e67958d790bf582b05da2c23e580a9b7cfa1c4ad9cdaa4107f0f76b
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15f20-19c1-75da-914e-2ed6138a6c9f.png
  Captured: 2026-10-21 15:41:48 UTC
  Source report: https://urlscan.io/result/01a15f20-19c1-75da-914e-2ed6138a6c9f/
  SHA-256: 46aaabc396583abc618c333c2b2f539e41c721568bbb3611fcd8a5dae4559e18

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T15:43:18Z",
        "uuid": "01a15de1-2d11-756f-bc0e-91ca89607e4a",
        "scanned_at": "2026-10-21T09:53:26Z",
        "final_url": "https://sitemvhxgcydip4z.cfd/",
        "globals": [
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass",
            "reloadButtonClick",
            "downloadButtonClick",
            "detailsButtonClick",
            "setAutoFetchState"
        ],
        "domain_age_days": 0,
        "apex_age_days": 0,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 81,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T15:43:20Z",
        "uuid": "da749f45-9826-42a6-ad90-5eb1f64a8291",
        "scanned_at": "2026-10-21T15:40:58Z",
        "final_url": "https://sitemvhxgcydip4z.cfd/login",
        "status": 200,
        "history": [
            {
                "url": "https://sitemvhxgcydip4z.cfd/",
                "status": 200
            },
            {
                "url": "https://sitemvhxgcydip4z.cfd/login",
                "status": 200
            }
        ],
        "dom_hash": "c591ad4aa7397a258c7bb087a4250226f42f2f575496f3fcf39cad52315f27ed",
        "doc_hash": "5311e799ef62120e4f36a36f763c5587b25d0f864856a6fcae6570b2fa5e5e88",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "DGA Domains",
            "Security threats",
            "Newly Seen Domains",
            "Security Risks",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "sitemvhxgcydip4z.cfd",
                "type": "A",
                "value": "172.67.198.121"
            },
            {
                "name": "sitemvhxgcydip4z.cfd",
                "type": "A",
                "value": "104.21.68.209"
            },
            {
                "name": "sitemvhxgcydip4z.cfd",
                "type": "AAAA",
                "value": "2606:4700:3030::6815:44d1"
            },
            {
                "name": "sitemvhxgcydip4z.cfd",
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:c679"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.198.121",
        "verdict": {
            "tags": [
                "dga domains"
            ],
            "malicious": true,
            "categories": [
                "dga domains"
            ]
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-10-21T09:46:26Z",
            "updated": "2026-10-21T09:46:27Z",
            "expires": "2027-10-21T23:59:59Z",
            "nameservers": [
                "lee.ns.cloudflare.com",
                "melinda.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T15:40:24Z",
        "analysis_at": "2026-10-21T09:53:21Z",
        "stats": {
            "timeout": 0,
            "harmless": 0,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 92
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Spaceship, Inc.",
        "created": "2026-10-21T09:46:26Z",
        "expires": "2027-10-21T23:59:59Z",
        "updated": "2026-10-21T09:46:27Z",
        "first_seen": "2026-10-21T09:53:35Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:c679"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "melinda.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::6815:44d1"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.68.209"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "lee.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.198.121"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "lee.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-21T09:53:42Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.sitemvhxgcydip4z.cfd",
                "sitemvhxgcydip4z.cfd"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "5d64c9b98f3a00ca96262fbada896b4f412",
            "sha256": "b04bc2060ff4fb1a1160b6ccf97f360b096f0f829159116b36aaee3b4a83e753",
            "subject": "sitemvhxgcydip4z.cfd",
            "valid_to": "2027-01-19T08:54:06Z",
            "valid_from": "2026-10-21T08:54:07Z"
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "registrar_iana_id": "3862",
            "registrar_url": "https://www.spaceship.com/",
            "created": "2026-10-21T09:46:26Z",
            "updated": "2026-10-21T09:46:27Z",
            "expires": "2027-10-21T23:59:59Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "lee.ns.cloudflare.com",
                "melinda.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-21T15:43:42Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "sitemvhxgcydip4z.cfd"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-21T15:34:27Z",
            "first": "2026-10-21T15:34:27Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 1668
        },
        "social_tags": {
            "title": "Archway"
        },
        "trackers": {
            "requests": 7,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 18,
                "tls": 59,
                "wait": 86,
                "connect": 59,
                "download": 0
            },
            "response_ms": 222
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 802,
            "co2_grams": 0,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.32.198",
                    "host": "melinda.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.33.129",
                    "host": "lee.ns.cloudflare.com"
                }
            ],
            "zone": "sitemvhxgcydip4z.cfd"
        },
        "location": {
            "ip": "2606:4700:3037::ac43:c679",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "sitemvhxgcydip4z.cfd"
        },
        "dns": {
            "A": [
                "104.21.68.209",
                "172.67.198.121"
            ],
            "NS": [
                "lee.ns.cloudflare.com",
                "melinda.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"lee.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418082321, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3037::ac43:c679",
                "2606:4700:3030::6815:44d1"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3030::6815:44d1",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://sitemvhxgcydip4z.cfd"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Google Font API",
                "Cloudflare",
                "HTTP/3"
            ]
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-10-21T09:46:26Z",
            "updated": "2026-10-21T09:46:27Z",
            "expires": "2027-10-21T23:59:59Z",
            "status": [
                "serverTransferProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "lee.ns.cloudflare.com",
                "melinda.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```