# PhishDestroy domain threat record: tongadivelive.programmers.us

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/tongadivelive.programmers.us/
Machine-readable companion: https://phishdestroy.io/domain/tongadivelive.programmers.us/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-24 07:56:57 UTC
- Last availability or vendor check: 2026-10-21 22:32:53 UTC
- Stored record updated: 2026-10-22 14:24:38 UTC
- VirusTotal detections in the stored snapshot: 7/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: Google

## Stored infrastructure

- Observed IP address: 50.116.92.157
- Registrar in stored WHOIS data: GoDaddy.com, LLC
- Registration date in stored WHOIS data: 2004-06-04 16:47:12 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01986406-0a0e-7089-a448-06ed5c0a0bbd/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/tongadivelive.programmers.us
- Certificate Transparency search: https://crt.sh/?q=%25.tongadivelive.programmers.us
- Web Archive lookup: https://web.archive.org/web/*/https://tongadivelive.programmers.us/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
tongadivelive.programmers.us is an impersonation phishing page hosted on a subdomain of programmers.us. It presented itself under the title "Tongadive – Deepdive into Technology.", the look of a harmless technology blog, while PhishDestroy classified it as impersonation phishing. PhishDestroy first saw it on 2026-09-24. The site has been offline since 2026-10-14 and was still unreachable at the last check on 2026-10-19.

How the scam works
Impersonation pages borrow the identity of a site or service people already trust, then use that trust to ask for something valuable: login credentials, contact or payment details, or, on crypto-themed lures, a wallet recovery phrase. A believable front lowers the visitor's guard before the request appears. The tech-blog title is what the page showed. The classification rests on the page's behaviour and on independent social-engineering verdicts, not on its headline. Anything typed into such a page goes straight to the operator.

Evidence
Google Safe Browsing labelled the site SOCIAL_ENGINEERING, the category browsers use to warn users away from deceptive pages. On 2026-10-03, VirusTotal showed 7 of 91 engines flagging it: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, G-Data, SOCRadar and VIPRE. That count is modest, but the vendors are independent of one another and agree with Google's verdict. PhishDestroy lists the domain on its own blocklist.

Infrastructure
The page ran on a subdomain under a shared parent domain rather than a dedicated registration. That lets an operator set up quickly and discard the site just as fast. It was served from an IP on Oracle Corporation's network in the US. Its Let's Encrypt certificate gave it a browser padlock, which only means the connection was encrypted, not that the site was legitimate. The site went offline roughly three weeks after PhishDestroy first saw it.

What to do
If you entered a password on this site, change it now, along with any account that reuses it, and turn on two-factor authentication. If you typed a wallet recovery phrase, treat that wallet as compromised and move your funds to a new wallet created on a clean device. If you shared card or banking details, contact your bank to block the card and watch your statements. Defenders should block the full hostname and check proxy and DNS logs for visits since 2026-09-24. Also watch for new lookalike subdomains under the same parent domain.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01986406-0a0e-7089-a448-06ed5c0a0bbd/
VirusTotal report: https://www.virustotal.com/gui/domain/tongadivelive.programmers.us
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=tongadivelive.programmers.us
Archived copy: https://web.archive.org/web/20260924075738/https://tongadivelive.programmers.us/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:15:56 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01986406-0a0e-7089-a448-06ed5c0a0bbd.png
  Captured: 2026-09-24 07:56:57 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4fd70bea-c75d-4f3e-8da3-3409ce40bcd7.png
  Captured: 2026-09-24 07:58:24 UTC
  Source report: https://radar.cloudflare.com/scan/4fd70bea-c75d-4f3e-8da3-3409ce40bcd7
  SHA-256: 2de540d4c47907ba42fb976405793b6fbd552122bcbc6a5388f6ee5d8cd6507e

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T21:00:25Z",
        "uuid": "01986406-0a0e-7089-a448-06ed5c0a0bbd",
        "scanned_at": "2025-08-01T05:06:44Z",
        "final_url": "https://tongadivelive.programmers.us/",
        "requests": 1
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:07:12Z",
        "uuid": "4fd70bea-c75d-4f3e-8da3-3409ce40bcd7",
        "scanned_at": "2026-09-24T07:58:24Z",
        "final_url": "https://tongadivelive.programmers.us/",
        "status": 200,
        "history": [
            {
                "url": "https://tongadivelive.programmers.us/",
                "status": 200
            }
        ],
        "dom_hash": "9cdc5e638e1cb7ae6004d96013f34e251284c1ae88ab275a72c221b0b56d0a63",
        "doc_hash": "e0b1211035badf49ee1eb03442eed6e67542e1cea096ea55926793feb4aa4393",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "tongadivelive.programmers.us",
                "type": "A",
                "value": "50.116.92.157"
            }
        ],
        "dnssec_valid": false,
        "ip": "50.116.92.157",
        "whois": {
            "registrar": "GoDaddy.com, LLC",
            "created": "2004-06-04T18:47:12Z",
            "updated": "2019-02-19T15:11:11Z",
            "expires": "2028-06-03T23:59:59Z",
            "nameservers": [
                "cns382.hostgator.com",
                "cns381.hostgator.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T19:36:37Z",
        "analysis_at": "2026-10-05T03:37:28Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 7,
            "suspicious": 1,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Information Technology, Phishing (alphaMountain.ai)"
        },
        "registrar": "GoDaddy.com, LLC",
        "created": "2004-06-04T18:47:12Z",
        "expires": "2028-06-03T23:59:59Z",
        "updated": "2019-02-19T15:11:11Z",
        "first_seen": "2026-01-31T00:30:52Z",
        "dns": [
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:50.116.92.143 ~all"
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "50.116.92.157"
            }
        ],
        "dns_at": "2026-09-29T04:02:37Z",
        "jarm": "29d29d15d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1",
        "cert": {
            "san": [
                "*.programmers.us",
                "*.pwaapp.programmers.us",
                "*.shopifylaravel.programmers.us",
                "*.tongadivelive.programmers.us",
                "*.website-d5bcbc2c.programmers.us"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6db7b2864498dd2c41850dc7dc1cd15f0dd",
            "sha256": "a4bd6aa53032ec3bf7d18098807bd583164fbed3ed7d320abd60055ec98f1a02",
            "subject": "*.website-d5bcbc2c.programmers.us",
            "valid_to": "2026-10-31T22:22:19Z",
            "valid_from": "2026-08-02T22:22:20Z"
        },
        "whois": {
            "registrar": "GoDaddy.com, LLC",
            "registrar_iana_id": "146",
            "registrar_url": "whois.godaddy.com",
            "created": "2004-06-04T18:47:12Z",
            "updated": "2019-02-19T15:11:11Z",
            "expires": "2028-06-03T23:59:59Z",
            "status": [
                "clientDeleteProhibited",
                "clientRenewProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "cns381.hostgator.com",
                "cns382.hostgator.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```