# PhishDestroy threat dossier — vntshot.top
================================================================

Fetched:   2026-07-22 18:43:11 UTC
Canonical: https://phishdestroy.io/domain/vntshot.top/

## VERDICT
----------------------------------------------------------------
CRITICAL THREAT — DO NOT VISIT
Composite threat score: 96/100 (PhishDestroy scoring — see methodology below)

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      7/91 security vendors flagged this domain
  Flagging vendors: alphaMountain.ai, Bfore.Ai PreCrime, CRDF, Emsisoft, Fortinet, Netcraft, Webroot
Public blocklists: listed on 1 independent blocklist

## INFRASTRUCTURE
----------------------------------------------------------------
IP address:      85.239.149.81 (DE, Frankfurt am Main)
ASN:             AS207043 DEDIK SERVICES LIMITED
Hosting org:     Dedik Services Limited
Registrar:       PDR Ltd. d/b/a PublicDomainRegistry.com
Nameservers:     a.dnspod.com, b.dnspod.com, c.dnspod.com
Registered:      2025-11-11
Expires:         2026-11-11
Page title:      Inventory Check | Fortnite

## TLS CERTIFICATE
----------------------------------------------------------------
Issuer:     Let's Encrypt / R13
Expires:    2026-08-23
Status:     INVALID chain
Fingerprint: cda0b15cf942c82e7da08c097dc1f4580ad79b6c8faa7421ad750d92ebaa93b2

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: pending notification queue. No abuse reports filed yet — this domain is
waiting for the next cycle of our automated abuse-reporter.

## TIMELINE
----------------------------------------------------------------
Domain registered: 2025-11-11 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration)
First detected:    2026-07-22 17:48:27 UTC (by PhishDestroy tracker)
First reported:    2026-07-22 15:51:38 UTC (abuse notice filed)
Last verified:     2026-07-22 20:30:16 UTC
Current status:    ACTIVE / observable

## EXTERNAL CORROBORATION (third-party evidence)
----------------------------------------------------------------
URLScan.io:       https://urlscan.io/result/019f8a82-cb10-75cb-af64-d114a64a3a6f/
URLQuery:         https://urlquery.net/report/6dfe50ba-3680-45a0-8469-f39ce273fcd1
Wayback Machine:  https://web.archive.org/web/*/vntshot.top
crt.sh CT logs:   https://crt.sh/?q=%25.vntshot.top
Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=vntshot.top
AlienVault OTX:   https://otx.alienvault.com/indicator/domain/vntshot.top
URLhaus:          https://urlhaus.abuse.ch/host/vntshot.top/

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-07-22 17:48:43 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

vntshot.top Phishing Site Detected

Analysis of the domain vntshot.top shows that it remains active as of the report date, July 22, 2026. The zone is hosted on the DNSPod nameservers a.dnspod.com, b.dnspod.com and c.dnspod.com, and the registration record indicates it was created on November 11, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to the IPv4 address 85.239.149.81, which is the sole host observed for this domain.

Threat intelligence from VirusTotal records that 7 of 95 scanning engines have flagged the domain, indicating a modest but non‑trivial detection rate. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy service, confirming that at least one external sinkhole has taken defensive action. No additional intelligence such as SSL certificate details, HTTP response codes, page title, or explicit brand impersonation is currently available, so the precise lure employed by the site cannot be confirmed.

Defenders should continue to monitor the domain's DNS and IP activity, enforce blocking of 85.239.149.81 at the network perimeter, and consider adding vntshot.top to internal block lists. Given the observed detection count and blocklist presence, the site should be treated as high‑risk until further evidence clarifies its payload or target audience. Ongoing collection of HTTP responses and page content is recommended to support future attribution and mitigation efforts.

## EVIDENCE HASHES
----------------------------------------------------------------
PhishDestroy Case ID:  PD-20260722-BD1E23
Favicon MD5:       c3dfd147f45b5e2fa32fad03a62a7b1f
TLS cert SHA-256:      cda0b15cf942c82e7da08c097dc1f4580ad79b6c8faa7421ad750d92ebaa93b2

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (operator takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/vntshot.top/
JSON API:          https://api.destroy.tools/v1/check?domain=vntshot.top
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: independent open-source threat-intelligence platform.
Tracked: 188,330 domains (57,775 alive under monitoring, 128,922 confirmed takedowns/dead). Site: https://phishdestroy.io