# PhishDestroy threat dossier — web3-singapore.pro
================================================================

Fetched:   2026-07-10 13:31:28 UTC
Canonical: https://phishdestroy.io/domain/web3-singapore.pro/

## VERDICT
----------------------------------------------------------------
CRITICAL THREAT — DO NOT VISIT
Composite threat score: 100/100 (PhishDestroy scoring — see methodology below)
Scam classification: Credential Phishing

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      4/95 security vendors flagged this domain
  Flagging vendors: ChainPatrol, Google Safebrowsing, Kaspersky, SOCRadar
Public blocklists: listed on 3 independent blocklists
Google Safe Browsing: FLAGGED

## INFRASTRUCTURE
----------------------------------------------------------------
IP address:      144.124.237.59 (NL, Amsterdam)
ASN:             AS216071 SERVERS TECH FZCO
Hosting org:     Servers Tech Fzco
Registrar:       Registrar of Domain Names REG.RU LLC
Nameservers:     ns1.reg.ru, ns2.reg.ru
Registered:      2026-07-09
Expires:         2027-07-09
Page title:      TOKEN2049 | The World's Largest Crypto Event
HTTP response:   200

## TLS CERTIFICATE
----------------------------------------------------------------
Issuer:     Let's Encrypt / YE2
Expires:    2026-10-07
Status:     INVALID chain
Fingerprint: 8bdd69e0dbb8f4524581516b95ae845b299c44ec1e6d0e17b1825b2c62682dd7
Subject Alternative Names (related infrastructure — often same operator):
  - www.web3-singapore.pro

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: pending notification queue. No abuse reports filed yet — this domain is
waiting for the next cycle of our automated abuse-reporter.

## TIMELINE
----------------------------------------------------------------
Domain registered: 2026-07-09 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration)
First detected:    2026-07-10 11:19:01 UTC (by PhishDestroy tracker)
Last verified:     2026-07-10 12:50:13 UTC
Current status:    ACTIVE / observable

## EXTERNAL CORROBORATION (third-party evidence)
----------------------------------------------------------------
URLScan.io:       https://urlscan.io/result/019f4b51-d4cf-730f-926a-5c6f43999050/
Wayback Machine:  https://web.archive.org/web/*/web3-singapore.pro
crt.sh CT logs:   https://crt.sh/?q=%25.web3-singapore.pro
Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=web3-singapore.pro
AlienVault OTX:   https://otx.alienvault.com/indicator/domain/web3-singapore.pro
URLhaus:          https://urlhaus.abuse.ch/host/web3-singapore.pro/

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-07-10 11:26:18 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

This domain, web3-singapore.pro, has been classified as a high-risk generic phishing threat, specifically targeting users through a potential fake login mechanism. The current status of this domain remains active, posing a continuous risk to unwitting users who may engage with it under the impression of legitimacy.

Analysis of the domain reveals a number of concerning data points: it was created on July 09, 2026, and is registered through REG.RU LLC. The domain resolves to the IP address 144.124.237.59, which may be part of a larger network of malicious domains. VirusTotal findings indicate that 4 out of 95 security vendors have flagged this domain, and Google Safe Browsing marks it for social engineering tactics. These factors contribute to the domain's identification within a concerning cyber threat landscape.

To mitigate risks associated with this domain, users should be advised not to provide any personal or financial information when encountering unfamiliar login prompts. Organizations should implement email filtering techniques to intercept communications that may contain links to this domain. Additionally, employing domain-based message authentication protocols can help reduce the chances of falling victim to such attacks, further enhancing organizational cybersecurity posture.

## EVIDENCE HASHES
----------------------------------------------------------------
Favicon MD5:       52ad48d708416985d7c2e0eb9ebfbb02
TLS cert SHA-256:      8bdd69e0dbb8f4524581516b95ae845b299c44ec1e6d0e17b1825b2c62682dd7

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (operator takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/web3-singapore.pro/
JSON API:          https://api.destroy.tools/v1/check?domain=web3-singapore.pro
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: independent open-source threat-intelligence platform.
Tracked: 177,044 domains (24,684 alive under monitoring, 152,336 confirmed takedowns/dead). Site: https://phishdestroy.io