# PhishDestroy threat dossier — upgrder.com ================================================================ Fetched: 2026-07-13 08:30:48 UTC Canonical: https://phishdestroy.io/domain/upgrder.com/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Crypto Drainer Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: status_split) (score: 1/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/91 security vendors flagged this domain Flagging vendors: Gridinsoft, Yandex Safebrowsing Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 45.199.188.12 (RU, Moscow) ASN: ASAS13335 CLOUDFLARENET - Cloudflare, Inc., US Hosting org: AS48282 Hosting technology LTD Registrar: Dominet (HK) Limited Nameservers: ns-cloud-c1.googledomains.com, ns-cloud-c2.googledomains.com, ns-cloud-c3.googledomains.com, ns-cloud-c4.googledomains.com Registered: 2026-07-05 Expires: 2027-07-05 Page title: Апгрейд предметов КС2: лучший Upgrader CS HTTP response: 301 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-10-03 Status: INVALID chain Fingerprint: 757a925d7cb5f96c7fcf9447dc48ea6d260c12cf5cd47ce906bc825ef7d338cf Subject Alternative Names (related infrastructure — often same operator): - www.upgrder.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-05 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-07 14:32:33 UTC (by PhishDestroy tracker) Last verified: 2026-07-13 08:20:41 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f3c8e-ff92-7359-acb0-3ea51320ac64/ Wayback Machine: https://web.archive.org/web/*/upgrder.com crt.sh CT logs: https://crt.sh/?q=%25.upgrder.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=upgrder.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/upgrder.com URLhaus: https://urlhaus.abuse.ch/host/upgrder.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-07 14:34:45 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, upgrder.com, is identified as an active crypto drainer phishing site designed to deceive users into authorizing malicious transactions that siphon cryptocurrency from connected wallets. The site mimics legitimate wallet upgrade prompts, tricking victims into signing smart contracts that transfer funds to attacker-controlled addresses. Analysis of the domain reveals infrastructure commonly associated with high-risk financial fraud operations targeting decentralized finance (DeFi) users. Infrastructure analysis indicates the domain was registered on July 05, 2026, through Dominet (HK) Limited, a registrar frequently observed in phishing campaigns. It resolves to the IP address 109.172.84.90 and uses a Let's Encrypt SSL certificate to present a false sense of legitimacy. As of the latest assessment, only 1 out of 95 security vendors on VirusTotal flag this domain, suggesting low initial detection rates and potential evasion of automated defenses. The domain's recent creation date and minimal blocklist coverage further highlight its attempt to operate undetected. Users who have interacted with upgrder.com should immediately revoke any suspicious wallet authorizations and disconnect the site from connected applications. All cryptocurrency transactions initiated through this domain should be considered compromised, and affected wallets should be audited for unauthorized transfers. It is recommended to monitor wallet activity for unusual smart contract interactions and report the domain to relevant security platforms to improve detection and prevent further victimization. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 757a925d7cb5f96c7fcf9447dc48ea6d260c12cf5cd47ce906bc825ef7d338cf ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/upgrder.com/ JSON API: https://api.destroy.tools/v1/check?domain=upgrder.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 178,033 domains (49,760 alive under monitoring, 128,273 confirmed takedowns/dead). Site: https://phishdestroy.io