# PhishDestroy domain threat record: strong-auth.cyou

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/strong-auth.cyou/
Machine-readable companion: https://phishdestroy.io/domain/strong-auth.cyou/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 13:19:24 UTC
- Last availability or vendor check: 2026-10-22 13:19:24 UTC
- Stored record updated: 2026-10-22 16:30:26 UTC
- VirusTotal detections in the stored snapshot: 2/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: OpenPhish
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Solana

## Stored infrastructure

- Observed IP address: 104.21.39.185
- Registrar in stored WHOIS data: Hosting Concepts B.V. d/b/a Registrar.eu
- Last stored HTTP status: 200
- Registration date (registry RDAP, strong-auth.cyou): 2026-10-19 13:13:37 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a163c2-c152-746f-9446-f91917df4432/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/strong-auth.cyou
- Certificate Transparency search: https://crt.sh/?q=%25.strong-auth.cyou
- Web Archive lookup: https://web.archive.org/web/*/https://strong-auth.cyou/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI classified the site as malicious because the recorded page title “$GRAM Mining — Connect Solana Wallet” and accompanying text invite visitors to link a Solana wallet for mining, a pattern typical of crypto‑drainer sites. The domain was first seen by PhishDestroy on 2026-10-22, three days after its registration on 2026-10-19. An HTTP request on that date returned a 200 status code.

How the scam works
Crypto‑drainer schemes present a fake mining or reward service and ask users to connect their cryptocurrency wallet, often via a web‑based wallet or browser extension. Once the user authorises the connection, the attacker can initiate transactions that move funds out of the wallet without the user’s knowledge.

Evidence
VirusTotal scanned the domain on 2026-10-20 and reported two detections, labeling it as suspicious (alphaMountain.ai) and spam (Fortinet). Google Safe Browsing checked the URL on 2026-10-22 and did not flag it. URLScan captured a screenshot on 2026-10-22 and returned a clean verdict. PhishDestroy’s internal blocklist marked the domain as malicious on 2026-10-22. Cloudflare Radar scanned the site on 2026-10-22 and returned a malicious phishing verdict. OTX listed three pulses referencing the domain as of 2026-10-22. No external blocklists reported the domain as of the same date.

Infrastructure
The domain was registered on 2026-10-19 through Hosting Concepts B.V. d/b/a Registrar.eu. The domain resolved to Cloudflare IPs 104.21.39.185 and 172.67.171.47, and the recorded TLS certificate was a Let’s Encrypt certificate issued on 2026-10-19. The authoritative nameservers were lauryn.ns.cloudflare.com and mark.ns.cloudflare.com, and the network was identified as Cloudflare, Inc. in the United States.

What to do
Visitors should avoid connecting any wallet to this site. Defenders should block strong-auth.cyou at DNS or proxy level, monitor outbound connections to the recorded IPs, and log any access attempts for further investigation.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a163c2-c152-746f-9446-f91917df4432/
Cloudflare Radar report: https://radar.cloudflare.com/scan/8b7a386f-df21-47ec-85b9-62aa55480c6e
URLQuery report: https://urlquery.net/report/4f8144b9-6993-4d02-a42f-7976cc730378
Stored capture screenshot: https://i.ibb.co/Y4BNM4fx/8a0e7358a08a.png
Cloudflare Radar screenshot (2026-10-22T13:56:50Z): https://screenshots.phishdestroy.io/cf/8b7a386f-df21-47ec-85b9-62aa55480c6e.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/4f8144b9-6993-4d02-a42f-7976cc730378.png
URLScan screenshot (2026-10-22T13:06:06Z): https://screenshots.phishdestroy.io/us/01a163b7-c92f-7132-aaee-ca9cdbe9c131.png
URLScan capture report: https://urlscan.io/result/01a163b7-c92f-7132-aaee-ca9cdbe9c131/
URLScan screenshot (2026-10-22T13:40:09Z): https://screenshots.phishdestroy.io/us/01a163d7-0d98-74ac-844d-809b1984c18c.png
URLScan capture report: https://urlscan.io/result/01a163d7-0d98-74ac-844d-809b1984c18c/
VirusTotal report: https://www.virustotal.com/gui/domain/strong-auth.cyou
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=strong-auth.cyou
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 14:00:32 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Y4BNM4fx/8a0e7358a08a.png
  Captured: 2026-10-22 13:19:24 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a163c2-c152-746f-9446-f91917df4432.png
  Captured: 2026-10-22 13:19:24 UTC
  Source report: https://urlscan.io/result/01a163c2-c152-746f-9446-f91917df4432/
- URLScan capture 2: https://urlscan.io/screenshots/01a163b7-c92f-7132-aaee-ca9cdbe9c131.png
  Captured: 2026-10-22 13:11:41 UTC
  Source report: https://urlscan.io/result/01a163c2-c152-746f-9446-f91917df4432/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/8b7a386f-df21-47ec-85b9-62aa55480c6e.png
  Captured: 2026-10-22 13:56:50 UTC
  Source report: https://radar.cloudflare.com/scan/8b7a386f-df21-47ec-85b9-62aa55480c6e
  SHA-256: f02ef2b2b0d31142b3f96b0a6cc39a62a7217ce163b19bf7e4d9705d044a1f9b
- URLQuery: https://screenshots.phishdestroy.io/uq/4f8144b9-6993-4d02-a42f-7976cc730378.png
  Source report: https://urlquery.net/report/4f8144b9-6993-4d02-a42f-7976cc730378
  SHA-256: e0d3aa2221c8761623a757223f5ee3f2b04d45c70a6670c158ce49ad5f7c39fa
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163b7-c92f-7132-aaee-ca9cdbe9c131.png
  Captured: 2026-10-22 13:06:06 UTC
  Source report: https://urlscan.io/result/01a163b7-c92f-7132-aaee-ca9cdbe9c131/
  SHA-256: 976b840c2c07abcdf849e6bd48b6aa4703f052996756fbf7a468eef0e887458c
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163d7-0d98-74ac-844d-809b1984c18c.png
  Captured: 2026-10-22 13:40:09 UTC
  Source report: https://urlscan.io/result/01a163d7-0d98-74ac-844d-809b1984c18c/
  SHA-256: 976b840c2c07abcdf849e6bd48b6aa4703f052996756fbf7a468eef0e887458c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T14:30:17Z",
        "uuid": "01a163c2-c152-746f-9446-f91917df4432",
        "scanned_at": "2026-10-22T13:18:32Z",
        "final_url": "https://strong-auth.cyou/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://strong-auth.cyou/",
                "from": "http://strong-auth.cyou/",
                "status": 307
            }
        ],
        "ip": "104.21.39.185",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com",
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "192.179.18.94",
            "142.251.179.95",
            "104.16.79.73",
            "104.21.39.185"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "phantom.com"
        ],
        "doc_hash": "ee4521bfa06fc61870e96bee14a45194c654e55c6596a639d80c74d02a38c8d9",
        "script_hashes": [
            "75a412ff36f794a0e372b97c0866901a43a18cc566583cb46f493284ae9d719a",
            "1b344c4a80425e5a39a0ee2649f6180fd573201906278d5084a0e3030628aed7"
        ],
        "globals": [
            "_uwmc",
            "litPropertyMetadata",
            "reactiveElementVersions",
            "litHtmlVersions",
            "litElementVersions",
            "__cfBeacon"
        ],
        "storage_keys": [
            "_0x12",
            "_0x5"
        ],
        "tls": {
            "san": [
                "*.strong-auth.cyou",
                "strong-auth.cyou"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "strong-auth.cyou",
            "protocol": "QUIC",
            "valid_to": "2027-01-17T12:32:01Z",
            "valid_from": "2026-10-19T12:32:02Z"
        },
        "domain_age_days": 2,
        "apex_age_days": 2,
        "tls_age_days": 3,
        "tls_valid_days": 89,
        "requests": 14,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T13:59:29Z",
        "uuid": "8b7a386f-df21-47ec-85b9-62aa55480c6e",
        "scanned_at": "2026-10-22T13:56:50Z",
        "final_url": "https://strong-auth.cyou/",
        "status": 200,
        "history": [
            {
                "url": "https://strong-auth.cyou/",
                "status": 200
            }
        ],
        "dom_hash": "14e139d1df1b4ea290ae6c0db0b1a0bd3928a0199a52a0b07910d3b176f4df3d",
        "doc_hash": "ee4521bfa06fc61870e96bee14a45194c654e55c6596a639d80c74d02a38c8d9",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains",
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "strong-auth.cyou",
                "type": "A",
                "value": "104.21.39.185"
            },
            {
                "name": "strong-auth.cyou",
                "type": "A",
                "value": "172.67.171.47"
            },
            {
                "name": "strong-auth.cyou",
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:ab2f"
            },
            {
                "name": "strong-auth.cyou",
                "type": "AAAA",
                "value": "2606:4700:3036::6815:27b9"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.39.185",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
            "created": "2026-10-19T13:13:37Z",
            "updated": "2026-10-19T13:19:22Z",
            "expires": "2027-10-19T23:59:59Z",
            "nameservers": [
                "lauryn.ns.cloudflare.com",
                "mark.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T13:56:08Z",
        "analysis_at": "2026-10-20T10:07:08Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 0,
            "suspicious": 2,
            "undetected": 39
        },
        "detections": {
            "Fortinet": "spam",
            "alphaMountain.ai": "suspicious"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Suspicious (alphaMountain.ai)"
        },
        "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
        "created": "2026-10-19T13:13:37Z",
        "expires": "2027-10-19T23:59:59Z",
        "updated": "2026-10-19T13:19:22Z",
        "first_seen": "2026-10-19T14:50:29Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::6815:27b9"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.39.185"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "mark.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.171.47"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:ab2f"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "lauryn.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "lauryn.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-20T10:12:32Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.strong-auth.cyou",
                "strong-auth.cyou"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5ebd724d997f67c14a66c3ee1d7b2bd263c",
            "sha256": "aba87ac6ff6e5e472b7e686c94a8b370726902a35f6e044c8825f0ed3bf3f63e",
            "subject": "strong-auth.cyou",
            "valid_to": "2027-01-17T12:32:01Z",
            "valid_from": "2026-10-19T12:32:02Z"
        },
        "whois": {
            "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
            "registrar_iana_id": "1647",
            "registrar_url": "https://www.openprovider.com/",
            "created": "2026-10-19T13:13:37Z",
            "updated": "2026-10-19T13:19:22Z",
            "expires": "2027-10-19T23:59:59Z",
            "status": [
                "addPeriod",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "lauryn.ns.cloudflare.com",
                "mark.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T13:56:45Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "strong-auth.cyou"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "social_tags": {
            "title": "$GRAM Mining — Connect Solana Wallet",
            "ogType": "website",
            "ogTitle": "$GRAM Mining — Connect Solana Wallet",
            "keywords": "GRAM Mining, Solana, SOL, wallet",
            "ogSiteName": "$GRAM Mining",
            "themeColor": "#070C0F",
            "description": "Connect your Solana wallet to $GRAM Mining. Wallet authentication is not configured yet.",
            "twitterCard": "summary",
            "ogDescription": "Your mining. Your wallet. Prepare to connect your Solana wallet to $GRAM Mining."
        },
        "trackers": {
            "requests": 11,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 2
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 2
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 16,
                "wait": 306,
                "connect": 41,
                "download": 1
            },
            "response_ms": 366
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 9887,
            "co2_grams": 0.0004,
            "cleaner_than": 72
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.193.130",
                    "host": "mark.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.194.22",
                    "host": "lauryn.ns.cloudflare.com"
                }
            ],
            "zone": "strong-auth.cyou"
        },
        "location": {
            "ip": "2606:4700:3036::6815:27b9",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "San Francisco",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "strong-auth.cyou"
        },
        "dns": {
            "A": [
                "104.21.39.185",
                "172.67.171.47"
            ],
            "NS": [
                "mark.ns.cloudflare.com",
                "lauryn.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"lauryn.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417928949, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3030::ac43:ab2f",
                "2606:4700:3036::6815:27b9"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3036::6815:27b9",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://strong-auth.cyou"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Node.js",
                "Vue.js",
                "Nuxt.js",
                "lit-html",
                "lit-element",
                "Cloudflare",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "external": [
                "https://phantom.com/"
            ],
            "external_count": 1,
            "internal_count": 1
        },
        "whois": {
            "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
            "created": "2026-10-19T13:13:37Z",
            "updated": "2026-10-19T13:19:22Z",
            "expires": "2027-10-19T23:59:59Z",
            "status": [
                "serverTransferProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "lauryn.ns.cloudflare.com",
                "mark.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```