# PhishDestroy threat dossier — webdisk.weeniecat.com
================================================================

Fetched:   2026-07-25 23:45:06 UTC
Canonical: https://phishdestroy.io/domain/webdisk.weeniecat.com/

## VERDICT
----------------------------------------------------------------
TAKEN DOWN (neutralised)
Composite threat score: 49/100 (PhishDestroy scoring — see methodology below)

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      4/91 security vendors flagged this domain
  Flagging vendors: BitDefender, G-Data, SOCRadar, VIPRE
Public blocklists: listed on 1 independent blocklist

## INFRASTRUCTURE
----------------------------------------------------------------
IP address:      209.42.24.161 (CA, Toronto)
ASN:             AS36218 WHG Hosting Services Ltd
Hosting org:     WHG Hosting Services Ltd
Registrar:       eNom, LLC
Nameservers:     ["dns1.hostmds.com", "dns2.hostmds.com"]
HTTP response:   401

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: CLOSED — no report required.
This domain was neutralised before the abuse-report cycle could be dispatched — either
the hosting provider / registrar suspended it on their own, the DNS went dead, or the
operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file
for audit but no formal notice was sent.

## TIMELINE
----------------------------------------------------------------
First detected:    2026-07-25 11:53:10 UTC (by PhishDestroy tracker)
Last verified:     2026-07-26 00:23:20 UTC
Neutralised:       2026-07-25 12:00:18 UTC
Current status:    taken down (registrar suspended or DNS dead)

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-07-25 11:54:06 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

webdisk.weeniecat.com Generic Phishing Alert

Analysis of the domain webdisk.weeniecat.com indicates an active generic phishing infrastructure. The domain resolves to the authoritative name servers dns1.hostmds.com and dns2.hostmds.com, both hosted by the provider hostmds.com. Registration was performed through eNom, LLC, a registrar frequently associated with disposable or rapidly‑created domains. HTTP requests to the host return a 302 redirect, a pattern commonly used to forward victims to credential‑harvesting pages or to evade static analysis.

The domain is listed on a single security blocklist and has been blocked by the PhishDestroy filtering service, confirming that at least one operational sinkhole has identified it as malicious. VirusTotal scans show that four of ninety‑one antivirals label the domain as malicious, providing independent corroboration of its threat status. No additional intelligence such as page title, SSL certificate details, or hosting IP address is presently available, limiting the ability to pinpoint the exact backend infrastructure.

The lack of public page content suggests that the site may be transient or that content is delivered only after redirection. Defenders should incorporate webdisk.weeniecat.com into DNS‑based denylists, monitor outbound redirects from internal users, and enable URL filtering that captures HTTP 302 responses to unknown hosts. Continuous re‑evaluation is recommended, as the domain remains active and could be leveraged in future credential‑stealing campaigns.

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (operator takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/webdisk.weeniecat.com/
JSON API:          https://api.destroy.tools/v1/check?domain=webdisk.weeniecat.com
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: independent open-source threat-intelligence platform.
Tracked: 193,803 domains (63,437 alive under monitoring, 128,816 confirmed takedowns/dead). Site: https://phishdestroy.io