# PhishDestroy domain threat record: t-prolg.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/t-prolg.com/
Machine-readable companion: https://phishdestroy.io/domain/t-prolg.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-04 16:10:15 UTC
- Last availability or vendor check: 2026-10-25 02:19:15 UTC
- Stored record updated: 2026-10-26 19:34:44 UTC
- VirusTotal detections in the stored snapshot: 7/90
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: MetaMask

## Stored infrastructure

- Observed IP address: 104.21.48.188
- Registrar in stored WHOIS data: Realtime Register B.V.
- Registrar country in stored WHOIS data: Unknown
- Registration date (registry RDAP, t-prolg.com): 2026-07-22 10:42:33 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a06d2d-bfbe-77ec-bbcf-76c8ba36f59d/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/t-prolg.com
- Certificate Transparency search: https://crt.sh/?q=%25.t-prolg.com
- Web Archive lookup: https://web.archive.org/web/*/https://t-prolg.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
t-prolg.com is an impersonation phishing site that presented itself under the page title "T-Pro". The domain name is built to pass as a T-Pro address at a glance, and its presence on the MetaMask and SEAL blocklists points to crypto users as the intended audience. PhishDestroy first detected it on 2026-09-04. The site has been offline since 2026-09-11, and its DNS was still inactive when we last checked on 2026-10-19.

How the scam works
Impersonation pages like this copy the name and look of a brand the victim already trusts. Traffic usually arrives through ads, direct messages or search results. Once the visitor accepts the fake T-Pro page as real, it asks for something valuable: login credentials, a seed phrase or private key, a deposit, or a wallet connection that ends in a malicious signature. Whatever is entered goes straight to the operators. Stolen account access or wallet control lets them move funds out quickly, and those transfers usually cannot be reversed.

Evidence
On 2026-09-06, seven of 90 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, Kaspersky, SOCRadar and VIPRE. That is a minority of engines, but they come from several independent vendors. Two crypto-specific blocklists, MetaMask's and SEAL's, list it alongside PhishDestroy, so wallet software may warn users before they interact with the page. The domain also appears in five AlienVault OTX threat pulses, which shows that other researchers tracked it.

Infrastructure
The domain was registered through Realtime Register B.V. on 2026-07-22, about six weeks before PhishDestroy flagged it. The site resolved to Cloudflare, Inc. address space geolocated to Canada. Because Cloudflare acts as a reverse proxy, that address belongs to the content delivery network and does not identify the server that actually hosted the phishing page. The page went dark one week after our first detection.

What to do
If you entered a T-Pro password on this site, change it now, along with any account that reuses it, and turn on app-based 2FA. If you typed a seed phrase or private key into it, treat that wallet as compromised and move the remaining funds to a new wallet created on a clean device. If you connected a wallet or signed anything, review and revoke token approvals granted around 2026-09-04 to 2026-09-11. Defenders should block t-prolg.com and closely spelled T-Pro lookalikes, and watch for the same lure reappearing on newly registered domains.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a06d2d-bfbe-77ec-bbcf-76c8ba36f59d/
VirusTotal report: https://www.virustotal.com/gui/domain/t-prolg.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=t-prolg.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:23:02 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/GQwRZBvp/8cbd6cf2746d.png
  Captured: 2026-09-04 16:10:15 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a06d2d-bfbe-77ec-bbcf-76c8ba36f59d.png
  Captured: 2026-09-04 16:10:15 UTC
  Source report: https://urlscan.io/result/01a06d2d-bfbe-77ec-bbcf-76c8ba36f59d/
- URLQuery: https://screenshots.phishdestroy.io/uq/8354fd9c-32ba-4cd7-8c46-4689f3656a10.png
  Captured: 2026-09-04 16:26:21 UTC
  Source report: https://urlquery.net/report/8354fd9c-32ba-4cd7-8c46-4689f3656a10
  SHA-256: bea4274864890bc37522c1bc58c04f66b4a0741b7bbf44eb62da355e0efde69f
- URLScan · 2026-09-01: https://screenshots.phishdestroy.io/us/01a05d0b-bda9-7308-bfec-6efe37b7d57d.png
  Captured: 2026-09-01 12:57:47 UTC
  Source report: https://urlscan.io/result/01a05d0b-bda9-7308-bfec-6efe37b7d57d/
  SHA-256: 92da140c8daf888e1e0d2098692ebca15dce662f26096f3b455b5ae676cf518d
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06d1f-0429-710e-ab80-b6d4b0ea2dbf.png
  Captured: 2026-09-04 15:52:35 UTC
  Source report: https://urlscan.io/result/01a06d1f-0429-710e-ab80-b6d4b0ea2dbf/
  SHA-256: c504fbf49deab00f98e03058b58e665a635c8a6b23a3731584c96af3f323353c
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06e96-2c57-756e-abb9-fa721b8dc298.png
  Captured: 2026-09-04 22:42:27 UTC
  Source report: https://urlscan.io/result/01a06e96-2c57-756e-abb9-fa721b8dc298/
  SHA-256: c79020e8fde6042fe09977cdc016f3969c9d9541e685c5e9cdf01997e996da57
- URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07aa3-575e-7436-bfd7-38433e3817fd.png
  Captured: 2026-09-07 06:52:08 UTC
  Source report: https://urlscan.io/result/01a07aa3-575e-7436-bfd7-38433e3817fd/
  SHA-256: 1a0b80d2927964d221e6f57820223750243d16bd1f5e5f4494cf56d26f0d37c6
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/a86ccebd-1f6d-4320-abde-58da16c9ba00.png
  Captured: 2026-09-04 16:43:34 UTC
  Source report: https://radar.cloudflare.com/scan/a86ccebd-1f6d-4320-abde-58da16c9ba00
  SHA-256: 26ce4ac51eafeac0bab936e8e143d072f1bbc54866b349e37c5d687f6f4f6ed8

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T03:51:43Z",
        "uuid": "01a06d2d-bfbe-77ec-bbcf-76c8ba36f59d",
        "scanned_at": "2026-09-04T16:08:41Z",
        "final_url": "https://t-prolg.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://t-prolg.com/",
                "from": "http://t-prolg.com/",
                "status": 307
            }
        ],
        "ip": "104.21.48.188",
        "domains": [
            "webapi.t-proses.com",
            "e001-img.oss-cn-hongkong.aliyuncs.com",
            "storage.googleapis.com"
        ],
        "ips": [
            "142.251.127.207",
            "47.79.64.187",
            "104.21.11.89",
            "104.21.48.188"
        ],
        "asns": [
            "15169",
            "45102",
            "13335"
        ],
        "countries": [
            "US",
            "HK"
        ],
        "doc_hash": "36cd0476230b64eb5ac1f9cf87e3fbed4d45e07d1cdacf7a0a226333689534a7",
        "script_hashes": [
            "bcee984fd52b4a82bd6b23543bb33f6472e076c125edbdd8756d29ca230628cb",
            "5e8dbaf177dea2ae04a4f9ddf8fa3e0c75aa4a9ef40f29f4142ede98a4247d23",
            "f49f5a0ed02f7c3dbb9a0bf55e82a499556784d2c99355dbdd7a29ae4bc1c17f",
            "f1b8d1b55a1e7c9554485f7fb8670e36a73e55960de0878c4614e68c92be432f",
            "980b4cd838841ae8051d404ab19237b97baf4ad96b9b9b9073e64ab35bc97f11",
            "df268d4a93f2872f725a62a4af5c730d7b805af971a15320cb0eda38c9a0b517",
            "b189d35d4860077e6e9ac919aaba964dd433c590b33b20aec82c52394afbfdeb",
            "e3b98450c9d05eab23939602b6630cfae819f35fd8ca79374971908b2e350a1d",
            "29290bfa987b5cd369b3a5a417afd46b7f9abe9ae20dd3d81f5fffdfddb3d3a0",
            "90ccce7b3c29cfc63be01fda9a355768a23d56dfd4ae545ab424d8436051175a"
        ],
        "globals": [
            "TradingView",
            "addLink",
            "addMeta",
            "lib",
            "rem",
            "dpr",
            "__INTLIFY_PROD_DEVTOOLS__",
            "__INTLIFY_JIT_COMPILATION__",
            "__INTLIFY_DROP_MESSAGE_COMPILER__",
            "PubSub",
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_I18N_FULL_INSTALL__",
            "__VUE_I18N_LEGACY_API__",
            "__config",
            "__theme",
            "__VUE__",
            "__vite_is_modern_browser"
        ],
        "storage_keys": [
            "lastRefreshTime",
            "dev_THEME",
            "main",
            "dev_LANGUAGE",
            "user",
            "hasLoadedApp"
        ],
        "tls": {
            "san": [
                "t-prolg.com",
                "*.t-prolg.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "t-prolg.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-20T10:45:40Z",
            "valid_from": "2026-07-22T09:48:09Z"
        },
        "domain_age_days": 61,
        "apex_age_days": 61,
        "tls_age_days": 44,
        "tls_valid_days": 90,
        "requests": 104,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "cryptoscam"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Crypto Scam"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T04:01:52Z",
        "uuid": "a86ccebd-1f6d-4320-abde-58da16c9ba00",
        "scanned_at": "2026-09-04T16:43:34Z",
        "final_url": "https://t-prolg.com/pc/",
        "status": 200,
        "history": [
            {
                "url": "https://t-prolg.com/",
                "status": 200
            },
            {
                "url": "https://t-prolg.com/pc/",
                "status": 200
            }
        ],
        "dom_hash": "1a441cddfed452733f2cb9a435f1636ef988ab24df044a8842d31645a012556c",
        "doc_hash": "4d593b0f9e7bb90453a860ef6c3aa3449fd76a371b49128772d7ca102d128c15",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "t-prolg.com",
                "type": "A",
                "value": "104.21.48.188"
            },
            {
                "name": "t-prolg.com",
                "type": "A",
                "value": "172.67.136.201"
            },
            {
                "name": "t-prolg.com",
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:88c9"
            },
            {
                "name": "t-prolg.com",
                "type": "AAAA",
                "value": "2606:4700:3031::6815:30bc"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.48.188",
        "whois": {
            "registrar": "Realtime Register B.V.",
            "created": "2026-07-22T10:42:33Z",
            "updated": "2026-07-22T10:44:39Z",
            "expires": "2027-07-22T10:42:33Z",
            "nameservers": [
                "dorthy.ns.cloudflare.com",
                "osmar.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T03:51:13Z",
        "analysis_at": "2026-10-11T22:07:08Z",
        "stats": {
            "timeout": 0,
            "harmless": 48,
            "malicious": 7,
            "suspicious": 2,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "malware",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "spam"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "Realtime Register B.V.",
        "created": "2026-07-22T10:42:33Z",
        "expires": "2027-07-22T10:42:33Z",
        "updated": "2026-09-20T10:43:17Z",
        "first_seen": "2026-07-22T11:13:20Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "dorthy.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::6815:30bc"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "osmar.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:88c9"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.48.188"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dorthy.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.136.201"
            }
        ],
        "dns_at": "2026-09-06T02:02:33Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "t-prolg.com",
                "*.t-prolg.com"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "1f879defba8ab7a60e72b19bf8b1d46a",
            "sha256": "98ceab13c35fe75d3c925de1f2d424be6a20a38169ee1b0722cd21dc98f29e86",
            "subject": "t-prolg.com",
            "valid_to": "2026-10-20T10:45:40Z",
            "valid_from": "2026-07-22T09:48:09Z"
        },
        "whois": {
            "registrar": "Realtime Register B.V.",
            "registrar_iana_id": "839",
            "registrar_url": "http://www.realtimeregister.com",
            "created": "2026-07-22T10:42:33Z",
            "updated": "2026-09-20T10:43:17Z",
            "expires": "2027-07-22T10:42:33Z",
            "status": [
                "clientHold"
            ],
            "nameservers": [
                "dorthy.ns.cloudflare.com",
                "osmar.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "expiration": "2027-07-22T10:42:33Z",
                "last changed": "2026-09-20T10:43:18Z",
                "registration": "2026-07-22T10:42:33Z",
                "registrar expiration": "2027-07-22T10:42:33Z",
                "last update of RDAP database": "2026-10-11T22:14:21Z"
            }
        }
    }
}
```