# PhishDestroy threat dossier — splendidfinancial.xyz ================================================================ Fetched: 2026-07-27 12:07:16 UTC Canonical: https://phishdestroy.io/domain/splendidfinancial.xyz/ ## VERDICT ---------------------------------------------------------------- HIGH THREAT — malicious activity confirmed Composite threat score: 72/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 11/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Lionic, Netcraft, Sophos AlienVault OTX: 4 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 198.187.29.22 Registrar: NAMECHEAP INC Nameservers: dns1.namecheaphosting.com, dns2.namecheaphosting.com Registered: 2024-09-10 Expires: 2026-09-10 Page title: Splendid financial - Home HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Sectigo Limited / Sectigo Public Server Authentication CA DV R36 Expires: 2026-09-12 Status: INVALID chain Fingerprint: 655000e86a06b723a6757774db60b183196b8495970d64c5728e4b1e4a8722e6 Subject Alternative Names (related infrastructure — often same operator): - www.splendidfinancial.xyz ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2024-09-10 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-27 08:33:50 UTC (by PhishDestroy tracker) Last verified: 2026-07-27 12:58:31 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019fa270-fdcf-7654-9703-d6972ea53a67/ Wayback Machine: https://web.archive.org/web/*/splendidfinancial.xyz crt.sh CT logs: https://crt.sh/?q=%25.splendidfinancial.xyz Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=splendidfinancial.xyz AlienVault OTX: https://otx.alienvault.com/indicator/domain/splendidfinancial.xyz URLhaus: https://urlhaus.abuse.ch/host/splendidfinancial.xyz/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-27 08:34:50 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Is splendidfinancial.xyz a phishing site? Analysis indicates that the domain splendidfinancial.xyz, created on September 10 2024 and hosted on the IP address 198.187.29.22, is actively being used for a generic phishing campaign. The registrar listed is Namecheap Inc, and the authoritative name servers are dns1.namecheaphosting.com and dns2.namecheaphosting.com. VirusTotal reports that 11 of 91 security vendors have flagged the domain, demonstrating a moderate level of detection across multiple scanners. The domain appears on a single external blocklist and is currently listed as blocked by the PhishDestroy service, confirming that at least one threat‑intelligence feed has recognized its malicious intent. The risk rating assigned by internal assessment is high, and the operational status remains active as of the report date, July 27 2026. Infrastructure analysis shows no additional evidence of SSL certificates, HTTP response codes, or page‑title metadata in the available data set; consequently, the exact content of the hosted page has not been publicly disclosed. The limited visibility does not preclude the domain from being leveraged in credential‑harvesting attacks, and the presence of multiple vendor detections suggests that the site likely presents deceptive content designed to lure victims into submitting personal or financial information. Defenders should proactively add splendidfinancial.xyz to network‑level blocklists, enforce DNS filtering, and monitor outbound connections to the associated IP address. Continuous re‑scanning with multi‑vendor engines is advised to capture any changes in detection status, and security teams should correlate internal logs for any attempted connections to this domain to identify possible compromise attempts. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: dcce3f61d5d1e3d2260682970a18e6c1 TLS cert SHA-256: 655000e86a06b723a6757774db60b183196b8495970d64c5728e4b1e4a8722e6 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/splendidfinancial.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=splendidfinancial.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 204,940 domains (80,137 alive under monitoring, 123,772 confirmed takedowns/dead). Site: https://phishdestroy.io