# PhishDestroy domain threat record: vrooomin.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/vrooomin.com/ Machine-readable companion: https://phishdestroy.io/domain/vrooomin.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-07 13:27:41 UTC - Last availability or vendor check: 2026-10-21 01:14:04 UTC - Stored record updated: 2026-10-22 14:25:02 UTC - VirusTotal detections in the stored snapshot: 4/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: whatsapp ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: DropCatch.com 854 LLC - Registrar country in stored WHOIS data: ID - Registration date (registry RDAP, vrooomin.com): 2026-09-01 18:32:45 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a07c0c-99bf-7079-8046-a257c635dfec/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/vrooomin.com - Certificate Transparency search: https://crt.sh/?q=%25.vrooomin.com - Web Archive lookup: https://web.archive.org/web/*/https://vrooomin.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview vrooomin.com posed as CHINA788, an online gambling brand, and promoted itself in Indonesian as a "recommended solution" for winning big. It targeted Indonesian-speaking players looking for slot and casino sites. PhishDestroy first flagged it on 2026-09-07, six days after the domain was registered. The site has been offline since 2026-09-11 and was still unreachable, with no active DNS, on 2026-10-19. How the scam works The page title, "CHINA788 # Rekomendasi Solusi Untuk Mendapatkan Hasil Kemenangan Tinggi", reads like a slot-gambling promotion promising high winnings. We classify the site as impersonation phishing, while the title itself presents an ordinary gambling advertisement. Copycat gambling portals like this typically borrow a known brand's name to collect sign-ups, login details and deposits sent by bank transfer or e-wallet. Victims risk losing the money they deposit, along with any account credentials or payment details they type into the fake site. Evidence On 2026-09-08, 4 of 89 VirusTotal engines flagged the domain: ESET, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. That is a low count, but several unrelated vendors reached the same conclusion independently. urlscan.io rated the page malicious and matched it to a generic gambling brand template. The domain also appears in 4 AlienVault OTX threat pulses, and PhishDestroy lists it on its blocklist. Infrastructure Only six days passed between registration on 2026-09-01 and detection, and the site was gone ten days after registration. A lifespan that short is common for disposable promotion domains. The registrar, DropCatch.com 854 LLC, mainly handles re-registration of expiring domain names. The site ran behind Cloudflare at 188.114.97.3, geolocated to Canada, which conceals the real origin server. What to do If you registered or deposited through vrooomin.com, contact your bank or e-wallet provider right away and ask about reversing or disputing the transfers. Do not pay any "unlock" or "withdrawal" fee to release supposed winnings. If you reused the password you entered there, change it on every other account that uses it and turn on two-factor authentication. Security teams should block the domain and check DNS and proxy logs for lookups between 2026-09-01 and 2026-09-11. They should also watch for new domains that use the CHINA788 name with a similar Indonesian promotional title. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a07c0c-99bf-7079-8046-a257c635dfec/ VirusTotal report: https://www.virustotal.com/gui/domain/vrooomin.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=vrooomin.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:21:49 UTC ## Stored page captures - Primary capture: https://i.ibb.co/hFDsVQ3W/6a7784aef745.png Captured: 2026-09-07 13:27:41 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a07c0c-99bf-7079-8046-a257c635dfec.png Captured: 2026-09-07 13:27:41 UTC Source report: https://urlscan.io/result/01a07c0c-99bf-7079-8046-a257c635dfec/ - URLScan capture 2: https://urlscan.io/screenshots/01a07ab3-1180-70a5-9838-f177e1b88ff5.png Captured: 2026-09-07 13:26:29 UTC Source report: https://urlscan.io/result/01a07c0c-99bf-7079-8046-a257c635dfec/ - URLQuery: https://screenshots.phishdestroy.io/uq/112daa9c-111d-4a8c-8c57-5549eec85597.png Captured: 2026-09-07 13:31:15 UTC Source report: https://urlquery.net/report/112daa9c-111d-4a8c-8c57-5549eec85597 SHA-256: fb83d2f5f7f4f214ecfc2633c899455c6db5981fd51bd3f87d61dd707634c24a - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b559ef53-78d3-463d-9680-f16f85d58c0f.png Captured: 2026-09-07 13:30:20 UTC Source report: https://radar.cloudflare.com/scan/b559ef53-78d3-463d-9680-f16f85d58c0f SHA-256: d897a4d5e568a579d31a7edff27750632649d847bb97d4c3146f192a5a7c650f - URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07ab3-1180-70a5-9838-f177e1b88ff5.png Captured: 2026-09-07 07:09:30 UTC Source report: https://urlscan.io/result/01a07ab3-1180-70a5-9838-f177e1b88ff5/ SHA-256: 27dac4f520dcb7df1f20628ad8ab15115b0e0265390c9feb79325a192ee40b40 - URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07c0f-3020-75ed-9fed-206a26bb54a9.png Captured: 2026-09-07 13:29:35 UTC Source report: https://urlscan.io/result/01a07c0f-3020-75ed-9fed-206a26bb54a9/ SHA-256: 64ff07f29050dbc41a357a635b4c48ac7e22e246ffe6085252b5f98a33aceee5 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T02:29:12Z", "uuid": "01a07c0c-99bf-7079-8046-a257c635dfec", "scanned_at": "2026-09-07T13:26:43Z", "final_url": "https://vrooomin.com/", "status": 200, "ip": "188.114.97.3", "domains": [ "www.mothercare.co.id", "js.klevu.com", "static.cloudflareinsights.com", "l.sharethis.com", "api2.branch.io", "platform-cdn.sharethis.com", "ipv4check.ksearchnet.com", "visitor.service.ksearchnet.com", "statsjs.klevu.com", "js-agent.newrelic.com", "t.sharethis.com", "maps.googleapis.com", "region1.google-analytics.com", "buttons-config.sharethis.com", "app.link", "maps.google.com", "platform-api.sharethis.com", "cdn.branch.io", "www.googletagmanager.com", "ipv6check.ksearchnet.com" ], "ips": [ "162.247.243.39", "99.84.152.117", "13.35.58.60", "2.23.7.25", "172.217.119.4", "216.239.32.36", "145.239.193.91", "108.131.184.204", "3.68.22.167", "3.171.214.119", "54.192.35.29", "104.16.79.73", "142.251.14.100", "3.160.150.115", "108.138.26.116" ], "asns": [ "54113", "16509", "20940", "15169", "16276", "13335" ], "countries": [ "US", "DE", "FR", "IE" ], "link_domains": [ "china788new-c7c4f5.gitlab.io", "www.mothercare.co.id" ], "doc_hash": "97a02d25970598102eea29bc2244123d9c253655116ff478deb8ca0981c996a8", "globals": [ "LOCALE", "BASE_URL", "VIEW_URL", "required", "require", "NREUM", "webpackChunk:NRBA-1.284.1.PROD", "newrelic", "branch", "klevu_lang", "klevu_baseCurrencyCode", "klevu_currentCurrencyCode", "klevu_pubIsInUse", "klevu_current_version", "_klvWebhook", "_klvReady", "klevu", "_klvAnalyticsCollect", "_klvAnalyticsEvent", "klevu_addPriceSuffixToQueryControl", "klevu_currencySymbols", "klevu_priceFormatters", "klevu_urlProtocol", "klevu_javascriptDomain", "klevunoUiSlider", "noUiSlider", "wNumb", "gtag", "dataLayer", "nowUnixtime", "klevufejs_getCookie", "klevufejs_cookie", "klevuData", "xhttp", "cookiesConfig", "googleMapsConfig", "checkout", "st", "__stdos__", "tpcCookiesEnableCheckingDone" ], "cookies": [ "mage-cache-sessid", "_ga_404GXE7LR3", "_ga", "fpestid", "_s", "section_data_ids" ], "storage_keys": [ "test", "klv_kmcData_klevu-159060263433311987", "__sharethis_local_storage_test__", "klv_user_klevu-159060263433311987_klvDataProtected", "klv_user_klevu-159060263433311987_sessionInfo", "klv_user_klevu-159060263433311987_connectorInfo", "klv_user_klevu-159060263433311987_segmentInfo", "klv_user_klevu-159060263433311987_segments", "klv_user_klevu-159060263433311987_lastSend", "klv_user_klevu-159060263433311987_ipv4", "klv_user_klevu-159060263433311987_ipv6", "klv_user_klevu-159060263433311987_uuid", "klv_user_klevu-159060263433311987_lastSendIp", "mage-cache-storage", "__sak" ], "tls": { "san": [ "vrooomin.com", "*.vrooomin.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "vrooomin.com", "protocol": "QUIC", "valid_to": "2026-12-03T23:49:41Z", "valid_from": "2026-09-04T22:52:12Z" }, "domain_age_days": 2264, "apex_age_days": 2264, "tls_age_days": 2, "tls_valid_days": 90, "requests": 194, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 83, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericgambling" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic Gambling" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html", "x-powered-by": "CyberPanel-OLS/2.5.0" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T03:58:17Z", "uuid": "b559ef53-78d3-463d-9680-f16f85d58c0f", "scanned_at": "2026-09-07T13:30:20Z", "final_url": "https://vrooomin.com/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://vrooomin.com/", "status": 307 }, { "url": "https://vrooomin.com/", "status": 200 } ], "dom_hash": "c88bc14732e0ff58d91e927ea2a1baf7c81ba6167df74a94b126d3ff64e24d57", "doc_hash": "9817b55af1de49e27d85474afafa159d9ab0c6ef59c1a0c80f552db79d9e66e8", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "vrooomin.com", "type": "A", "value": "188.114.96.3" }, { "name": "vrooomin.com", "type": "A", "value": "188.114.97.3" }, { "name": "vrooomin.com", "type": "AAAA", "value": "2a06:98c1:3120::3" }, { "name": "vrooomin.com", "type": "AAAA", "value": "2a06:98c1:3121::3" } ], "dnssec_valid": false, "ip": "188.114.96.3", "whois": { "registrar": "DropCatch.com 854 LLC", "created": "2026-09-01T18:32:45Z", "updated": "2026-09-04T23:49:24Z", "expires": "2027-09-01T18:32:45Z", "nameservers": [ "gloria.ns.cloudflare.com", "rory.ns.cloudflare.com" ] } } } ```