# PhishDestroy threat dossier — u81v.xyz ================================================================ Fetched: 2026-07-30 16:11:34 UTC Canonical: https://phishdestroy.io/domain/u81v.xyz/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 7/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, LevelBlue, SOCRadar, Webroot AlienVault OTX: 4 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 103.244.148.113 (HK, Hong Kong) ASN: AS135357 HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED Hosting org: Shenzhenshihong Technology Development Co., Ltd Registrar: Gname.com Pte. Ltd. Nameservers: ["ns1.1111343.com", "ns2.1111343.com", "ns3.1111343.com", "ns4.1111343.com"] Page title: Welcome HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-09-14 Status: INVALID chain Fingerprint: 4ccacf11b59b6eef2962940d63576cfa0138ef28b87d16ec2864ebee3eb0eea9 Subject Alternative Names (related infrastructure — often same operator): - 87114.xyz - 87119.xyz - 87125.xyz - 87260.xyz - e123e.vip - e123k.vip - e125c.xyz - f220e.xyz - f220g.xyz - f221s.xyz - g38c.xyz - g38g.xyz - g39i.xyz - g39q.xyz - g39t.xyz ... +83 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-28 18:43:09 UTC (by PhishDestroy tracker) Last verified: 2026-07-30 16:20:23 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-28 18:53:06 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] u81v.xyz Safety Check — Phishing Site Detected Analysis of the domain u81v.xyz, observed on 28 July 2026, identifies it as an active generic phishing infrastructure. The domain is registered through Gname.com Pte. Ltd. and resolves to the IPv4 address 103.244.148.113. DNS resolution is served by four authoritative name servers (ns1‑ns4.1111343.com), a pattern commonly associated with malicious hosting. Reputation checks show that the domain appears on a single security blocklist and is listed as blocked by the PhishDestroy service, indicating prior detection by anti‑phishing filters. VirusTotal has recorded three positive detections out of ninety‑one scanned security vendors, confirming that multiple independent scanners have flagged the domain as malicious. An HTTP request to the host returns a 200 OK status, demonstrating that the site is actively serving content. The risk rating assigned is high, consistent with the generic phishing classification. While the available data confirms the domain’s malicious intent, several investigative dimensions remain unavailable. No information is provided regarding SSL/TLS configuration, page title, or any observed brand impersonation, limiting the ability to assess the specific lure employed. Geographic location of the hosting IP, autonomous system number, and any associated malware kits are also absent from the current intelligence set. Consequently, the full scope of the threat—such as the targeted victim population or the credential‑ harvesting mechanism—cannot be precisely quantified. Defenders should incorporate u81v.xyz into domain‑based blocklists and update intrusion‑prevention signatures to drop traffic to the listed IP address. Network monitoring should alert on DNS queries for the four name servers, as they may be reused across additional phishing campaigns. Because the site returns HTTP 200, web‑proxy filtering solutions should be configured to inspect and block any outbound attempts to retrieve content from this host. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 4ccacf11b59b6eef2962940d63576cfa0138ef28b87d16ec2864ebee3eb0eea9 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/u81v.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=u81v.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,932 domains (83,630 alive under monitoring, 110,042 confirmed takedowns/dead). Site: https://phishdestroy.io