# PhishDestroy domain threat record: tokyosanno.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/tokyosanno.com/
Machine-readable companion: https://phishdestroy.io/domain/tokyosanno.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-18 20:37:56 UTC
- Last availability or vendor check: 2026-10-22 10:08:07 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 16/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: wordpress

## Stored infrastructure

- Observed IP address: 60.43.158.50
- Registrar in stored WHOIS data: Japan Registry Services Co., Ltd.
- Last stored HTTP status: 200
- Registration date (registry RDAP, tokyosanno.com): 2011-11-28 02:25:28 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019fca52-f7e3-7629-80f7-40c0fb8140f9/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/tokyosanno.com
- Certificate Transparency search: https://crt.sh/?q=%25.tokyosanno.com
- Web Archive lookup: https://web.archive.org/web/*/https://tokyosanno.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
tokyosanno.com is classified by PhishDestroy as an impersonation phishing page: a site that presents itself as someone it is not in order to win visitors' trust. Its targets are people who believe they are dealing with a legitimate organisation and act on that belief. PhishDestroy first flagged it on 2026-09-18. On 2026-10-19 the site was still online and serving live content.

How the scam works
Impersonation pages copy the look, wording and branding of an organisation the victim already trusts. Visitors are then steered toward an action that benefits the operator, such as signing in, filling in a form with personal or payment details, or sending money. Because the page feels familiar, victims rarely question it. What they lose depends on what they type in. Account passwords can be used to take over the real account, while card or banking details can lead to direct financial loss.

Evidence
On 2026-09-29, 16 of 91 VirusTotal engines flagged the domain. They include BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, G-Data, alphaMountain.ai, ADMINUSLabs and CyRadar. That is a minority of engines, but the flagging group mixes major antivirus vendors with specialist URL classifiers, so the verdict does not rest on a single source. The domain also appears in 30 AlienVault OTX threat pulses, which shows other researchers have been tracking it. Among public blocklists, it is currently listed by PhishDestroy.

Infrastructure
The domain was registered on 2011-11-28, nearly fifteen years before PhishDestroy detected it. That is an unusually long history compared with the throwaway domains common in phishing. Its registrar is Japan Registry Services Co., Ltd., and the site is hosted in Japan on the NTT DOCOMO BUSINESS, Inc. network. It also holds an organisation-validated TLS certificate from JPRS. Visitors should not read the padlock or the certificate type as proof that the page is safe to use.

What to do
If you entered a password on this site, change it right away on the real service and on any other account that shares it. Turn on two-factor authentication and review recent sign-ins. If you submitted card or bank details, contact your bank to block the card and dispute unfamiliar charges. If you shared personal information, watch for follow-up phishing messages that use it. Security teams should block tokyosanno.com at the DNS and proxy layer, search mail and web logs for users who visited it, and reset credentials for anyone who interacted with it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019fca52-f7e3-7629-80f7-40c0fb8140f9/
VirusTotal report: https://www.virustotal.com/gui/domain/tokyosanno.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=tokyosanno.com
Archived copy: https://web.archive.org/web/20260922061836/https://tokyosanno.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:40:02 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019fca52-f7e3-7629-80f7-40c0fb8140f9.png
  Captured: 2026-09-18 20:37:56 UTC
- URLScan capture: https://screenshots.phishdestroy.io/019fca52-f7e3-7629-80f7-40c0fb8140f9.png
  Captured: 2026-09-19 03:30:05 UTC
  Source report: https://urlscan.io/result/019fca52-f7e3-7629-80f7-40c0fb8140f9/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/71af4d71-2a81-43b3-a41e-d8b81a371105.png
  Captured: 2026-09-18 20:40:12 UTC
  Source report: https://radar.cloudflare.com/scan/71af4d71-2a81-43b3-a41e-d8b81a371105
  SHA-256: 36d07495bcca5f3e48f8eca8aedf572633b1c8597772c12bfb5fcf7563770e66
- URLScan · 2026-09-18: https://screenshots.phishdestroy.io/us/01a0b648-6f5d-74ba-aa7f-21641a5c21aa.png
  Captured: 2026-09-18 20:50:01 UTC
  Source report: https://urlscan.io/result/01a0b648-6f5d-74ba-aa7f-21641a5c21aa/
  SHA-256: 19366514bd7419612cd4ff2d8a0a2fd00ed7f19547120a8199dc0c64811f9e14
- URLScan · 2026-09-18: https://screenshots.phishdestroy.io/us/01a0b653-9f96-72f9-9696-c121c917a4dc.png
  Captured: 2026-09-18 21:02:29 UTC
  Source report: https://urlscan.io/result/01a0b653-9f96-72f9-9696-c121c917a4dc/
  SHA-256: b861d0aa3da4761e55d5d06dd54ba8811350db48b5c43be02071e502deceb464
- URLScan · 2026-09-18: https://screenshots.phishdestroy.io/us/01a0b65d-6c64-7289-a367-da14357d1cee.png
  Captured: 2026-09-18 21:12:58 UTC
  Source report: https://urlscan.io/result/01a0b65d-6c64-7289-a367-da14357d1cee/
  SHA-256: b861d0aa3da4761e55d5d06dd54ba8811350db48b5c43be02071e502deceb464

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:28:09Z",
        "uuid": "019fca52-f7e3-7629-80f7-40c0fb8140f9",
        "scanned_at": "2026-08-04T01:11:08Z",
        "final_url": "https://tokyosanno.com/www.paypal-resolution.center.co.uk/encripted/ssl218.site/identification.html",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://tokyosanno.com/www.paypal-resolution.center.co.uk/encripted/ssl218.site/identification.html",
                "from": "http://tokyosanno.com/www.paypal-resolution.center.co.uk/encripted/ssl218.site/identification.html",
                "status": 307
            }
        ],
        "ip": "60.43.158.50",
        "ptr": "tokyosanno.com",
        "ips": [
            "60.43.158.50"
        ],
        "asns": [
            "4713"
        ],
        "countries": [
            "JP"
        ],
        "doc_hash": "d844cdc5c949c88c9acc74d7fc1bce9614484631fb86ba5501912d15046a4dbc",
        "tls": {
            "san": [
                "*.bizmw.com",
                "bizmw.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "JPRS Organization Validation Authority - G4",
            "subject": "*.bizmw.com",
            "protocol": "TLS 1.2",
            "valid_to": "2026-10-31T14:59:59Z",
            "valid_from": "2025-10-01T00:06:06Z"
        },
        "domain_age_days": 1265,
        "apex_age_days": 1265,
        "tls_age_days": 307,
        "tls_valid_days": 395,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -47,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/7.4.33"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:34:08Z",
        "uuid": "71af4d71-2a81-43b3-a41e-d8b81a371105",
        "scanned_at": "2026-09-18T20:40:12Z",
        "final_url": "https://tokyosanno.com/",
        "history": [
            {
                "url": "https://tokyosanno.com/",
                "status": 0
            }
        ],
        "dom_hash": "f7a48cc844a2898cdb50aa55394e2633ea45e5ef13dc1aed1292ed349b65d815",
        "domain_risks": [
            "Government/Legal",
            "Government & Politics"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "tokyosanno.com",
                "type": "A",
                "value": "60.43.158.50"
            }
        ],
        "dnssec_valid": false,
        "whois": {
            "registrar": "Japan Registry Services Co., Ltd.",
            "created": "2011-11-28T02:25:28Z",
            "updated": "2025-11-23T15:19:04Z",
            "expires": "2026-11-28T02:25:28Z",
            "nameservers": [
                "mwns1.customer.ne.jp",
                "mwns2.customer.ne.jp"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T04:51:18Z",
        "analysis_at": "2026-10-13T12:05:30Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 17,
            "suspicious": 0,
            "undetected": 31
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "ADMINUSLabs": "malicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds. political organizations"
        },
        "registrar": "Japan Registry Services Co., Ltd.",
        "created": "2011-11-28T02:25:28Z",
        "expires": "2026-11-28T02:25:28Z",
        "updated": "2025-11-23T15:19:04Z",
        "first_seen": "2023-10-02T00:28:29Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "NS",
                "value": "mwns2.customer.ne.jp"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "host-plan-ac.ntt.com",
                "value": "mwns1.customer.ne.jp"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mwbgw2.ocn.ad.jp",
                "priority": 10
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 a include:_spf.bizmw.com ~all"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "mwns1.customer.ne.jp"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mwbgw1.ocn.ad.jp",
                "priority": 10
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "60.43.158.50"
            }
        ],
        "dns_at": "2026-10-13T12:07:18Z",
        "jarm": "07d2ad16d21d21d00007d2ad07d21dd7d473c13818c4075312b20b785cad90",
        "cert": {
            "san": [
                "*.bizmw.com",
                "bizmw.com"
            ],
            "issuer": "Japan Registry Services Co., Ltd. / JPRS Organization Validation Authority - G4",
            "serial": "7cd4391fd1d8e685bca660716f757efc",
            "sha256": "7f416447b0b15808aa15335abec08c56abb826534528c304c943d9e036f0a7dd",
            "subject": "*.bizmw.com",
            "valid_to": "2026-10-31T14:59:59Z",
            "valid_from": "2025-10-01T00:06:06Z"
        },
        "whois": {
            "registrar": "Japan Registry Services Co., Ltd.",
            "registrar_iana_id": "1485",
            "registrar_url": "http://jprs.jp/registrar/",
            "created": "2011-11-28T02:25:28Z",
            "updated": "2025-11-23T15:19:04Z",
            "expires": "2026-11-28T02:25:28Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "mwns1.customer.ne.jp",
                "mwns2.customer.ne.jp"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2025-11-23T15:19:04Z",
                "registration": "2011-11-28T02:25:28Z",
                "registrar expiration": "2026-11-28T02:25:28Z",
                "last update of RDAP database": "2026-10-10T23:23:23Z"
            }
        }
    }
}
```