# PhishDestroy threat dossier — tikfestawarding24.satupintu.events
================================================================

Fetched:   2026-06-26 14:19:44 UTC
Canonical: https://phishdestroy.io/domain/tikfestawarding24.satupintu.events/

## VERDICT
----------------------------------------------------------------
TAKEN DOWN (neutralised)
Composite threat score: 45/100 (PhishDestroy scoring — see methodology below)

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      0/95 security vendors flagged this domain
Public blocklists: listed on 1 independent blocklist
Victim re-reports (public form): 1

## INFRASTRUCTURE
----------------------------------------------------------------
IP address:      147.139.174.231 (ID, Jakarta)
ASN:             ASAS45102 ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN
Hosting org:     AS45102 Alibaba (US) Technology Co., Ltd.
Registrar:       HOSTINGER operations, UAB
Nameservers:     ["ns1.dns-parking.com", "ns2.dns-parking.com"]
Page title:      Tiktok Live Fest #CelebrateLive

## TLS CERTIFICATE
----------------------------------------------------------------
Issuer:     none
Status:     INVALID chain

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: CLOSED — no report required.
This domain was neutralised before the abuse-report cycle could be dispatched — either
the hosting provider / registrar suspended it on their own, the DNS went dead, or the
operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file
for audit but no formal notice was sent.

## TIMELINE
----------------------------------------------------------------
First detected:    2026-02-25 02:39:27 UTC (by PhishDestroy tracker)
First reported:    2025-09-10 11:30:10 UTC (abuse notice filed)
Last verified:     2026-06-26 12:20:35 UTC
Neutralised:       2026-05-13 12:00:42 UTC
Current status:    taken down (registrar suspended or DNS dead)

## EXTERNAL CORROBORATION (third-party evidence)
----------------------------------------------------------------
URLScan.io:       https://urlscan.io/result/01993408-886b-7638-88c9-2a68bca2af20/
Wayback Machine:  https://web.archive.org/web/*/tikfestawarding24.satupintu.events
crt.sh CT logs:   https://crt.sh/?q=%25.tikfestawarding24.satupintu.events
Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=tikfestawarding24.satupintu.events
AlienVault OTX:   https://otx.alienvault.com/indicator/domain/tikfestawarding24.satupintu.events
URLhaus:          https://urlhaus.abuse.ch/host/tikfestawarding24.satupintu.events/

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-06-18 18:37:22 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

The domain tikfestawarding24.satupintu.events was identified as a generic phishing threat impersonating TikTok Live Fest under the page title "Tiktok Live Fest #CelebrateLive". As of the latest analysis, the domain is offline, meaning it no longer resolves or serves content. The threat type is generic phishing, targeting users expecting to participate in or learn about TikTok's live festival event.

PhishDestroy research shows that this domain resolves to IP address 147.139.174.231 and was registered through HOSTINGER operations, UAB. It has been flagged by 0 of 95 VirusTotal vendors, indicating no detections at the time of analysis, but it appears on 1 security blocklist. The domain lacks an SSL certificate, which is a common red flag for phishing sites. The unique seed for this investigation is 5ef325.

Given that the domain is now offline, the immediate risk is reduced, but users should remain vigilant. Anyone who may have interacted with this site while it was active should monitor for suspicious activity and consider changing passwords or enabling multi-factor authentication on their TikTok accounts. PhishDestroy recommends avoiding any unsolicited links claiming to be from TikTok events and always verifying URLs through official channels.

## EVIDENCE HASHES
----------------------------------------------------------------
Favicon MD5:       7dd649046881b289f3cdfb8f4d73f074

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (volunteer takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/tikfestawarding24.satupintu.events/
JSON API:          https://api.destroy.tools/v1/check?domain=tikfestawarding24.satupintu.events
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: volunteer-driven open-source threat-intelligence platform.
Tracked: 170,516 domains (12,561 alive under monitoring, 157,587 confirmed takedowns/dead). Site: https://phishdestroy.io