# PhishDestroy domain threat record: vicecity.avmp.nl

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/vicecity.avmp.nl/
Machine-readable companion: https://phishdestroy.io/domain/vicecity.avmp.nl/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-11 11:26:23 UTC
- Last availability or vendor check: 2026-10-23 22:45:47 UTC
- Stored record updated: 2026-10-23 23:55:23 UTC
- VirusTotal detections in the stored snapshot: 3/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: solana

## Stored infrastructure

- Observed IP address: 172.67.143.236
- Registrar in stored WHOIS data: mijn.host
- Registrar country in stored WHOIS data: NL
- Last stored HTTP status: 200
- Registration date (registry RDAP, avmp.nl): 2026-06-13 13:35:18 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a12ab6-06bc-77de-8216-d5117d0c37c7/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/vicecity.avmp.nl
- Certificate Transparency search: https://crt.sh/?q=%25.vicecity.avmp.nl
- Web Archive lookup: https://web.archive.org/web/*/https://vicecity.avmp.nl/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
vicecity.avmp.nl presents itself as a cryptocurrency project called $VICECITY, branded with the tagline "Own The Streets. Rule The Chain." and designed to attract Web3 wallet holders looking to participate in a new token launch. PhishDestroy first identified it on 2026-10-11 and it remains fully live as of 2026-10-18. The site is classified as a crypto wallet drainer, meaning its purpose is to steal digital assets directly from visitors who connect their wallets.

How the scam works
Wallet drainer sites like this one lure users with the promise of a new token — in this case $VICECITY — and prompt them to connect a Web3 wallet to mint, claim, or purchase tokens. Once a wallet is connected, the underlying drainer contract requests a broad token approval or triggers a malicious transaction that transfers the victim's assets to attacker-controlled addresses. The victim loses cryptocurrency and any tokens held in the connected wallet, often within seconds of signing the transaction. The aggressive street-gang branding is typical of drainer kits designed to create urgency and excitement around a fake community token.

Evidence
Three of 92 engines on VirusTotal flagged this domain as malicious as of 2026-10-16; the vendors are CRDF, Forcepoint ThreatSeeker, and VIPRE. Detection coverage is low, which is common for freshly deployed drainer pages that have not yet been widely reported. PhishDestroy has independently confirmed the threat and added the domain to its blocklist. No additional blocklist coverage from Google Safe Browsing, Spamhaus, or urlscan.io is present in the current data.

Infrastructure
The domain was registered on 2026-06-13 through the Dutch registrar mijn.host and sits behind Cloudflare's network (AS13335) on an IP in the United States. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, giving the site a padlock that conveys no legitimacy. The domain itself is a subdomain of avmp.nl, which may indicate shared or compromised hosting infrastructure.

What to do
If you visited the site but did not connect a wallet, no immediate action is needed beyond avoiding any return visits. If you connected a wallet, immediately revoke all token approvals granted to any contract associated with this site using a tool such as a blockchain approval manager, then transfer remaining assets to a fresh wallet address. Report the site to your wallet provider and to any token platforms you use. Security teams and blocklist maintainers should add vicecity.avmp.nl to deny lists and monitor the parent domain avmp.nl for related infrastructure.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a12ab6-06bc-77de-8216-d5117d0c37c7/
VirusTotal report: https://www.virustotal.com/gui/domain/vicecity.avmp.nl
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=vicecity.avmp.nl
Archived copy: https://web.archive.org/web/20261011112826/https://vicecity.avmp.nl/
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-18 21:23:36 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/zTX27ZtL/5ba77dac7f1c.png
  Captured: 2026-10-11 11:26:23 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a12ab6-06bc-77de-8216-d5117d0c37c7.png
  Captured: 2026-10-11 11:26:23 UTC
  Source report: https://urlscan.io/result/01a12ab6-06bc-77de-8216-d5117d0c37c7/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f84ea9b9-6506-4e86-ab8d-42abedb7aad9.png
  Captured: 2026-10-12 10:16:11 UTC
  Source report: https://radar.cloudflare.com/scan/f84ea9b9-6506-4e86-ab8d-42abedb7aad9
  SHA-256: fb1b9cc1bf14bf7b8a90c1a7ac5621b6d4814e27689a181ed205d9892eb9b1f1
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12ab2-12b3-7167-ad44-f3a435e95e57.png
  Captured: 2026-10-11 11:21:32 UTC
  Source report: https://urlscan.io/result/01a12ab2-12b3-7167-ad44-f3a435e95e57/
  SHA-256: ee9eb823dbebe6aa32f50fe2c5263453e52365ca8c9f26bb23834a8105163253

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:53:27Z",
        "uuid": "01a12ab6-06bc-77de-8216-d5117d0c37c7",
        "scanned_at": "2026-10-11T11:25:41Z",
        "final_url": "https://vicecity.avmp.nl/",
        "status": 200,
        "ip": "104.21.55.14",
        "domains": [
            "fonts.gstatic.com",
            "fonts.reown.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com"
        ],
        "ips": [
            "104.20.46.121",
            "104.17.208.5",
            "142.251.14.94",
            "142.250.154.95",
            "104.21.55.14"
        ],
        "asns": [
            "13335",
            "15169"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "7632fb677d18f6d79175976d6cc528f72ccb076cf42be74b6a27f7819703e594",
        "script_hashes": [
            "359f13fbcba0802f06889e8421842e668aa2e414ca21e671e7018636c1e04601"
        ],
        "globals": [
            "showToast",
            "rspackChunk_686c63ac0fe54705",
            "Cap",
            "litPropertyMetadata",
            "reactiveElementVersions",
            "litHtmlVersions",
            "litElementVersions",
            "burger",
            "navLinks",
            "toast",
            "toastTimer"
        ],
        "storage_keys": [
            "vicecityAirdropDeadline"
        ],
        "tls": {
            "san": [
                "avmp.nl",
                "*.avmp.nl"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "avmp.nl",
            "protocol": "QUIC",
            "valid_to": "2026-11-18T01:19:59Z",
            "valid_from": "2026-08-20T00:20:10Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 2985,
        "tls_age_days": 52,
        "tls_valid_days": 90,
        "requests": 46,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 25,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html;charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:43:54Z",
        "uuid": "f84ea9b9-6506-4e86-ab8d-42abedb7aad9",
        "scanned_at": "2026-10-12T10:16:11Z",
        "final_url": "https://vicecity.avmp.nl/",
        "status": 200,
        "history": [
            {
                "url": "https://vicecity.avmp.nl/",
                "status": 200
            }
        ],
        "dom_hash": "31de08a9874bfc297b72d7a9ddcc045d8ffaf3268f079969c2f109009b9bf10c",
        "doc_hash": "beffa7b344e12c8b4e424b24768965838556c22923fd92ca1cc2b5d6624fff4c",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "vicecity.avmp.nl",
                "type": "A",
                "value": "104.21.55.14"
            },
            {
                "name": "vicecity.avmp.nl",
                "type": "A",
                "value": "172.67.143.236"
            },
            {
                "name": "vicecity.avmp.nl",
                "type": "AAAA",
                "value": "2606:4700:3036::6815:370e"
            },
            {
                "name": "vicecity.avmp.nl",
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:8fec"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.55.14",
        "whois": {
            "registrar": "mijn.host",
            "created": "2026-06-13T13:35:18Z",
            "updated": "2026-06-23T07:59:35Z",
            "nameservers": [
                "maisie.ns.cloudflare.com",
                "marek.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T00:30:39Z",
        "analysis_at": "2026-10-20T02:00:13Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 3,
            "suspicious": 0,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "created": "2026-06-13T00:00:00Z",
        "updated": "2026-06-23T00:00:00Z",
        "first_seen": "2026-09-21T20:04:01Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:8fec"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.55.14"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::6815:370e"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.143.236"
            }
        ],
        "dns_at": "2026-10-20T02:02:35Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "avmp.nl",
                "*.avmp.nl"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "b7c648ccd40bc2eb13b6b9d0ec6cc444",
            "sha256": "60a2c62ecdede4850ab0aa9272d9b4c73963c3fe44e49e53a4cc6e97830e55e3",
            "subject": "avmp.nl",
            "valid_to": "2027-01-16T06:22:29Z",
            "valid_from": "2026-10-18T05:24:55Z"
        },
        "whois": {
            "created": "2026-06-13T00:00:00Z",
            "updated": "2026-06-23T00:00:00Z",
            "dnssec": "no"
        }
    }
}
```