# tg8887.xyz: Vietnamese Online Betting and Casino Landing Page | PhishDestroy

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/tg8887.xyz/
Machine-readable companion: https://phishdestroy.io/domain/tg8887.xyz/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: Last known active
- First observed by PhishDestroy: 2026-11-04 06:58:41 UTC
- Selected availability observation: 2026-11-04T11:05:43Z
- Stored record updated: 2026-11-04 15:24:24 UTC
- VirusTotal detections in the stored snapshot: 4/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: checked_clean

## Stored infrastructure

- Observed IP address: 172.67.214.232
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200 (observed: 2026-11-04T11:05:43Z)
- Registration date in stored WHOIS data: 2026-07-16 10:36:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1a559-d93e-70aa-ae09-fd23fcf4d3ae/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/tg8887.xyz
- Certificate Transparency search: https://crt.sh/?q=%25.tg8887.xyz
- Web Archive lookup: https://web.archive.org/web/*/https://tg8887.xyz/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Public report package

PhishDestroy records tg8887.xyz as a Vietnamese-language landing page promoting sportsbook, live casino, slots, and local e-wallet payments.

The tg8887.xyz landing page presents itself in Vietnamese as an online betting and entertainment platform for Vietnam, with a headline describing it as a peak online betting destination. The page lists Sportsbook, Live Casino, Slot Online, slot machines and fish shooting games, and states that deposits and withdrawals use VND with support for MoMo, ZaloPay, VNPay and Viettel Money. A slot machine illustration accompanies the hero section, and counters show 500+ games, local payments, 24/7 customer support and a 21+ age requirement.

The stored VirusTotal domain result reports 4 detections out of 92 engines. Gridinsoft reported "suspicious"; alphaMountain.ai reported "suspicious".
Package revision: d9959bce88da25ea79f1162b38536b481a23c146e5a2b4a0799b2336bd3174f3
Text generated (not scan time): 2026-11-04 08:33:47
Reviewed evidence snapshot: {"domain":"tg8887.xyz","screenshot_available":true,"capture_contract":"verified-capture-20261102","plain_text_contract":1,"capture_context":{"submitted_host":"tg8887.xyz","final_host":"tg8887.xyz","redirects":[{"to":"https://tg8887.xyz/","from":"http://tg8887.xyz/","status":307}],"captured_at":"2026-11-04T06:58:20.675000Z","uuid":"01a1a559-d93e-70aa-ae09-fd23fcf4d3ae","report_url":"https://urlscan.io/result/01a1a559-d93e-70aa-ae09-fd23fcf4d3ae/","sha256":"abf4ca2d83e63349e87b54a4e378c9d9ce5d989a8e4f289130c38de1436cc0a3","relationship":"own_domain_page"},"redirect_text_policy":"explicit-redirect-v1","initial_ai_description":"The website tg8887.xyz presents itself as an online gambling platform, offering sports betting, live casino, slots, and fish shooting games, specifically targeting the Vietnamese market. It claims to be a 'leading online betting playground in Vietnam' and promotes features like fast deposits/withdrawals via local e-wallets (MoMo, ZaloPay, VNPay, Viettel Money). Online gambling is illegal in Vietnam, making any such platform operating within or targeting Vietnamese users inherently fraudulent.","initial_ai_description_kind":"unverified previous AI opinion","virustotal":{"scope":"domain","detections":4,"engines":92,"malicious":1,"suspicious":3,"analysis_date":"2026-11-01","retrieved_date":"2026-11-04","vendor_labels":{"Gridinsoft":"suspicious","alphaMountain.ai":"suspicious","Bfore.Ai PreCrime":"malicious","Forcepoint ThreatSeeker":"suspicious"},"flagging_vendors":["Gridinsoft","alphaMountain.ai","Bfore.Ai PreCrime","Forcepoint ThreatSeeker"]},"virustotal_public_summary":"The stored VirusTotal domain result reports 4 detections out of 92 engines. Gridinsoft reported \"suspicious\"; alphaMountain.ai reported \"suspicious\".","page_paragraph_target_characters":529}
Source facts (timestamps as stored): {"record_id":1782048,"first_recorded_at":"2026-11-04 07:58:41","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":4,"denominator":92,"malicious":1,"suspicious":3,"vendors":{"Gridinsoft":"suspicious","alphaMountain.ai":"suspicious","Bfore.Ai PreCrime":"malicious","Forcepoint ThreatSeeker":"suspicious"},"observed_at":"2026-11-01T10:59:04Z","checked_at":null,"fetched_at":"2026-11-04T07:30:30Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":4,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","Bfore.Ai PreCrime","Forcepoint ThreatSeeker","Gridinsoft"],"observed_at":"2026-11-01 10:59:04","checked_at":"2026-11-04 08:30:31","fetched_at":"2026-11-04 07:30:32","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"Gridinsoft":"suspicious","alphaMountain.ai":"suspicious","Bfore.Ai PreCrime":"malicious","Forcepoint ThreatSeeker":"suspicious"},"vendor_names":["Gridinsoft","alphaMountain.ai","Bfore.Ai PreCrime","Forcepoint ThreatSeeker"],"stats":{"timeout":0,"harmless":54,"malicious":1,"suspicious":3,"undetected":34}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-04 08:30:56"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-11-04 08:31:28"},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"current_http_probe","record_id":1782048,"scope":"checked_url","observed_at":"2026-11-04T11:05:43Z","http_status":200,"http_observed_at":"2026-11-04T11:05:43Z","stored_http_code":200,"stored_http_observed_at":"2026-11-04T11:05:43Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"served_at_root","content_classification_at":"2026-11-04T11:05:43Z","registration_state":"unknown","policy":"20261102-dated-availability-v2"}}

## Stored page captures

- URLScan · 2026-11-04: https://screenshots.phishdestroy.io/us/01a1a559-d93e-70aa-ae09-fd23fcf4d3ae.png
  Captured: 2026-11-04 06:58:20 UTC
  Source report: https://urlscan.io/result/01a1a559-d93e-70aa-ae09-fd23fcf4d3ae/
  SHA-256: abf4ca2d83e63349e87b54a4e378c9d9ce5d989a8e4f289130c38de1436cc0a3
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/789df111-4e87-41da-a3f1-b2f11063c6af.png
  Captured: 2026-11-04 07:31:21 UTC
  Source report: https://radar.cloudflare.com/scan/789df111-4e87-41da-a3f1-b2f11063c6af
  SHA-256: 2ab0623cb3a2338e948cd9e744db31a7a7220c60d7147a8bfca133c9f465d33a
- URLQuery: https://screenshots.phishdestroy.io/uq/68cad83d-7c33-4ed7-86b3-e04578cd2949.png
  Source report: https://urlquery.net/report/68cad83d-7c33-4ed7-86b3-e04578cd2949
  SHA-256: d6f04f03954b97a951b91b348e99523bef0d8006417cbbce379ce890cf33bf3e

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-11-04T06:59:36Z",
        "uuid": "01a1a559-d93e-70aa-ae09-fd23fcf4d3ae",
        "scanned_at": "2026-11-04T06:58:20Z",
        "final_url": "https://tg8887.xyz/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://tg8887.xyz/",
                "from": "http://tg8887.xyz/",
                "status": 307
            }
        ],
        "ip": "172.67.214.232",
        "domains": [
            "fonts.gstatic.com",
            "cdn.jsdelivr.net",
            "vn.datajs.net",
            "static.cloudflareinsights.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "2606:4700:3030::ac43:d74f",
            "104.16.179.112",
            "142.250.195.227",
            "2606:4700::6810:4f49",
            "2404:6800:4006:800::200a",
            "2606:4700::6810:b470",
            "172.67.214.232"
        ],
        "asns": [
            "13335",
            "15169"
        ],
        "countries": [
            "US",
            "AU"
        ],
        "link_domains": [
            "good8838.cc"
        ],
        "doc_hash": "0da05ae799bb9212e7b8e9e439fdd12e74b87b5b40eafa8af640ff150132a4da",
        "script_hashes": [
            "8463d8f6c91a91f5a26761abe221d3b4f3572914e9c7feb4ce283609f9482ff6",
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8"
        ],
        "globals": [
            "__brStickSimple",
            "uidEvent",
            "bootstrap",
            "AOS",
            "__cfBeacon"
        ],
        "tls": {
            "san": [
                "tg8887.xyz",
                "*.tg8887.xyz"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "tg8887.xyz",
            "protocol": "QUIC",
            "valid_to": "2026-12-14T10:25:21Z",
            "valid_from": "2026-09-15T09:25:24Z"
        },
        "domain_age_days": 110,
        "apex_age_days": 110,
        "tls_age_days": 49,
        "tls_valid_days": 90,
        "requests": 41,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-2aab354"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "priority": "u=0,i"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-11-04T07:33:04Z",
        "uuid": "789df111-4e87-41da-a3f1-b2f11063c6af",
        "scanned_at": "2026-11-04T07:31:21Z",
        "final_url": "https://tg8887.xyz/",
        "status": 200,
        "history": [
            {
                "url": "https://tg8887.xyz/",
                "status": 200
            }
        ],
        "dom_hash": "bb8d84543a16c69f07f26e792d0f365d3743d98f6b55c956cd2a23a219e80ee0",
        "doc_hash": "7388fd3912b6f264af3f8593998b29cf1100a91f4245a9ca138e5b723f5772b7",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "tg8887.xyz",
                "type": "A",
                "value": "104.21.91.92"
            },
            {
                "name": "tg8887.xyz",
                "type": "A",
                "value": "172.67.214.232"
            },
            {
                "name": "tg8887.xyz",
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:d6e8"
            },
            {
                "name": "tg8887.xyz",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:5b5c"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.17",
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-07-16T12:36:58Z",
            "updated": "2026-07-21T12:37:10Z",
            "expires": "2027-07-16T23:59:59Z",
            "nameservers": [
                "nile.ns.cloudflare.com",
                "sasha.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-11-04T07:30:30Z",
        "analysis_at": "2026-11-01T10:59:04Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 1,
            "suspicious": 3,
            "undetected": 34
        },
        "detections": {
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "suspicious",
            "Bfore.Ai PreCrime": "malicious",
            "Forcepoint ThreatSeeker": "suspicious"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "Google": "gambling",
            "alphaMountain.ai": "Gambling, Suspicious (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "elevated exposure"
        },
        "registrar": "Dynadot Inc",
        "created": "2026-07-16T12:36:58Z",
        "expires": "2027-07-16T23:59:59Z",
        "updated": "2026-07-21T12:37:10Z",
        "first_seen": "2026-07-16T16:10:14Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:d6e8"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.91.92"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "sasha.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:5b5c"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.214.232"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "nile.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "nile.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-11-01T11:00:46Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "tg8887.xyz",
                "*.tg8887.xyz"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "fc4d46658ae2c8d20e9bdab43f66ae1d",
            "sha256": "bf7dc87b7dd74280cb0cfb2d09ccb7cb782f5803f9991480278c8e10377e2fcb",
            "subject": "tg8887.xyz",
            "valid_to": "2026-12-14T10:25:21Z",
            "valid_from": "2026-09-15T09:25:24Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "http://www.dynadot.com",
            "created": "2026-07-16T12:36:58Z",
            "updated": "2026-07-21T12:37:10Z",
            "expires": "2027-07-16T23:59:59Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "nile.ns.cloudflare.com",
                "sasha.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-11-04T07:30:35Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-11-04T07:00:01Z",
            "first": "2026-11-04T07:00:01Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 14574
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://tg8887.xyz/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 15
        },
        "social_tags": {
            "ogUrl": "https://tg8887.xyz/",
            "title": "tg8887 – Sân Chơi Cá Cược Trực Tuyến Hàng Đầu Việt Nam",
            "ogType": "website",
            "ogImage": "https://tg8887.xyz/img/bais7oetm5h.jpg",
            "ogTitle": "tg8887 – Sân Chơi Cá Cược Trực Tuyến Hàng Đầu Việt Nam",
            "ogSiteName": "tg8887",
            "description": "tg8887 là nền tảng cá cược trực tuyến uy tín tại Việt Nam, cung cấp Sportsbook, Live Casino, Slot Online, Nổ Hũ và Bắn Cá. Nạp rút nhanh qua MoMo, ZaloPay, VNPay, Viettel Money.",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://tg8887.xyz/",
            "ogDescription": "tg8887 là nền tảng cá cược trực tuyến uy tín tại Việt Nam, cung cấp Sportsbook, Live Casino, Slot Online, Nổ Hũ và Bắn Cá. Nạp rút nhanh qua MoMo, ZaloPay, VNPay, Viettel Money."
        },
        "trackers": {
            "requests": 38,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 18
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 7
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js",
                "https://cdn.jsdelivr.net/npm/aos@2.3.4/dist/aos.js"
            ],
            "third_party_scripts": 2
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 4,
                "tls": 22,
                "wait": 561,
                "connect": 10,
                "download": 3
            },
            "response_ms": 600
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 64488,
            "co2_grams": 0.0024,
            "cleaner_than": 31
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "173.245.59.214",
                    "host": "nile.ns.cloudflare.com"
                },
                {
                    "ip": "162.159.38.69",
                    "host": "sasha.ns.cloudflare.com"
                }
            ],
            "zone": "tg8887.xyz"
        },
        "location": {
            "ip": "2606:4700:3031::ac43:d6e8",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "tg8887.xyz"
        },
        "dns": {
            "A": [
                "104.21.91.92",
                "172.67.214.232"
            ],
            "NS": [
                "sasha.ns.cloudflare.com",
                "nile.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"nile.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415161762, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3031::ac43:d6e8",
                "2606:4700:3037::6815:5b5c"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3031::ac43:d6e8",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://tg8887.xyz"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Google Maps",
                "Bootstrap",
                "jsDelivr",
                "Google Font API",
                "Bootstrap Icons",
                "AOS",
                "Cloudflare",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 17
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-07-16T12:36:58Z",
            "updated": "2026-07-21T12:37:10Z",
            "expires": "2027-07-16T23:59:59Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "nile.ns.cloudflare.com",
                "sasha.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```
Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/us/01a1a559-d93e-70aa-ae09-fd23fcf4d3ae.png","source":"URLScan","report_url":"https://urlscan.io/result/01a1a559-d93e-70aa-ae09-fd23fcf4d3ae/","captured_at":"2026-11-04T06:58:20Z","sha256":"abf4ca2d83e63349e87b54a4e378c9d9ce5d989a8e4f289130c38de1436cc0a3","model_image_sha256":"7396015ab740c881cc6f5531f60de628f3d74dd209324c482d9a49511d784c85","available":true,"content_status":null}

## Complete dated records
Availability observations: https://phishdestroy.io/domain/tg8887.xyz/records.json?source=availability&format=json
Source observation history: https://phishdestroy.io/domain/tg8887.xyz/records.json?source=detections&format=json
PhishStats records: https://phishdestroy.io/domain/tg8887.xyz/records.json?source=phishstats&format=json
Sent report records: https://phishdestroy.io/domain/tg8887.xyz/records.json?source=sent_reports&format=json
Report history: https://phishdestroy.io/domain/tg8887.xyz/records.json?source=report_history&format=json
Repeat report records: https://phishdestroy.io/domain/tg8887.xyz/records.json?source=rereports&format=json
Follow-up records: https://phishdestroy.io/domain/tg8887.xyz/records.json?source=followups&format=json
Content observations: https://phishdestroy.io/domain/tg8887.xyz/records.json?source=content&format=json

## Dated availability observation
Latest stored reachability observation
```json
{
    "state": "alive",
    "label_key": "availability.active",
    "detail_key": "detail.latest_reachability",
    "params": [],
    "source": "current_http_probe",
    "record_id": 1782048,
    "scope": "checked_url",
    "observed_at": "2026-11-04T11:05:43Z",
    "http_status": 200,
    "http_observed_at": "2026-11-04T11:05:43Z",
    "stored_http_code": 200,
    "stored_http_observed_at": "2026-11-04T11:05:43Z",
    "legacy_site_status": "alive",
    "supports_outcome_badge": false,
    "content_classification": "served_at_root",
    "content_classification_at": "2026-11-04T11:05:43Z",
    "registration_state": "unknown",
    "policy": "20261102-dated-availability-v2"
}
```