# PhishDestroy threat dossier — the-residence.shop ================================================================ Fetched: 2026-07-22 15:15:04 UTC Canonical: https://phishdestroy.io/domain/the-residence.shop/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 83/100 (PhishDestroy scoring — see methodology below) Scam classification: Credential Phishing ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 185.66.143.189 (NL, Roosendaal) ASN: ASAS200514 KnownSRV KnownSRV Ltd., GB Hosting org: AS200514 KnownSRV Ltd. Registrar: Dynadot Inc. Nameservers: ["corey.ns.cloudflare.com", "jasmine.ns.cloudflare.com"] Page title: The Residence Shop - Official The Residence Merchandise Store HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YE2 Expires: 2026-08-31 Status: INVALID chain Fingerprint: e4eb2d89419726a65ed9d36bbd7b8229a946449c7280bfa0fc8b87897a231761 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-12 18:06:49 UTC (by PhishDestroy tracker) Last verified: 2026-07-22 16:20:26 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f5714-628c-728b-a9fe-f4970e055ade/ Wayback Machine: https://web.archive.org/web/*/the-residence.shop crt.sh CT logs: https://crt.sh/?q=%25.the-residence.shop Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=the-residence.shop AlienVault OTX: https://otx.alienvault.com/indicator/domain/the-residence.shop URLhaus: https://urlhaus.abuse.ch/host/the-residence.shop/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-12 18:40:49 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Alert: the-residence.shop Credential Phishing Site Detected The domain the-residence.shop is currently active and has been identified as a credential phishing site. The site returns HTTP status 200 and presents the page title “The Residence Shop - Official The Residence Merchandise Store”. The domain is served through Cloudflare DNS with authoritative nameservers corey.ns.cloudflare.com and jasmine.ns.cloudflare.com, and resolves to the IPv4 address 185.66.143.189. No detections were reported by VirusTotal at the time of analysis (0/95). Infrastructure analysis reveals that the hosting IP belongs to a Cloudflare‑proxied address, which masks the underlying web server and complicates direct attribution. The use of Cloudflare’s DNS and CDN services is common among phishing operators seeking anonymity and resilience. The page title suggests an attempt to appear as an official merchandise store, but the content of the site has not been captured, so the exact phishing vector (e.g., credential capture form) remains unverified. Uncertainties include the lack of observed payload, login forms, or malicious scripts, as the assessment is based solely on passive DNS and HTTP header information. The absence of VirusTotal alerts does not imply safety; many phishing pages evade automated scanners until they are actively visited. Additionally, the IP address may be shared among multiple unrelated sites, so any correlation with other malicious activity must be validated through traffic analysis. Defenders should add the domain to blocklists at the DNS resolver level and monitor outbound connections to 185.66.143.189 for signs of credential‑exfiltration. Logging of HTTP requests to the domain can help confirm whether users are being directed to credential‑harvesting pages. If possible, request a takedown from the hosting provider and continue to track any changes to the DNS records or page title that could indicate a shift in the phishing campaign. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 646f1337efc7dc9ce9567857ff28b56d TLS cert SHA-256: e4eb2d89419726a65ed9d36bbd7b8229a946449c7280bfa0fc8b87897a231761 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/the-residence.shop/ JSON API: https://api.destroy.tools/v1/check?domain=the-residence.shop Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 188,194 domains (57,639 alive under monitoring, 128,922 confirmed takedowns/dead). Site: https://phishdestroy.io