# PhishDestroy threat dossier — wwwethereum.org ================================================================ Fetched: 2026-04-19 10:29:18 UTC Canonical: https://phishdestroy.io/domain/wwwethereum.org/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Ethereum ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 10/94 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, CyRadar, Forcepoint ThreatSeeker, G-Data, Lionic URLQuery: 2 detections Public blocklists: listed on 2 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 8.218.116.14 Registrar: GoDaddy.com, LLC Nameservers: ns03.domaincontrol.com, ns04.domaincontrol.com Registered: 2026-04-13 Page title: Ethereum HTTP response: 521 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: none Status: INVALID chain ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-13 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-15 10:44:28 UTC (by PhishDestroy tracker) First reported: 2026-04-15 07:46:29 UTC (abuse notice filed) Last verified: 2026-04-19 13:00:09 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d9017-61ca-71e1-b636-21bf55ca1585/ URLQuery: https://urlquery.net/report/8226fcda-09d9-4eb3-a05e-73c6d2df175a Wayback Machine: https://web.archive.org/web/*/wwwethereum.org crt.sh CT logs: https://crt.sh/?q=%25.wwwethereum.org Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=wwwethereum.org AlienVault OTX: https://otx.alienvault.com/indicator/domain/wwwethereum.org URLhaus: https://urlhaus.abuse.ch/host/wwwethereum.org/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-15 10:45:57 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies wwwethereum.org as an active domain impersonating the Ethereum cryptocurrency to deceive users and steal sensitive information or funds. This threat falls under brand impersonation, where attackers leverage the credibility of a well-known cryptocurrency to trick victims into engaging with malicious content. The domain poses an elevated risk due to its recent creation and association with fraudulent activities aimed at cryptocurrency users, who are particularly lucrative targets for threat actors. This domain was flagged by PhishDestroy with the following indicators: created on April 13, 2026, registered through GoDaddy.com, LLC, and resolving to IP address 8.218.116.14. Security vendor analysis via VirusTotal indicates detection by 8 out of 95 security vendors, suggesting limited but notable recognition of its malicious nature. Given its recent creation and low detection rate, this domain represents a growing hazard with potential to evade early-stage scrutiny from automated defenses. The combination of a trusted brand name and cryptocurrency context increases the likelihood of successful deception. To mitigate risk, users must avoid interacting with wwwethereum.org entirely and verify all URLs before clicking. Cryptocurrency holders should access official platforms directly via bookmarked links or manually typed URLs. Organizations should block this IP (8.218.116.14) and domain at the network perimeter to prevent accidental exposure. Report this domain to relevant authorities such as the Anti-Phishing Working Group (APWG) or local cybercrime units to aid in disruption efforts. Always use multi-factor authentication (MFA) on cryptocurrency accounts and enable transaction alerts to detect unauthorized activity promptly. Staying informed through threat intelligence feeds can help prevent future exposure to similar impersonation campaigns. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260415-15461B ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/wwwethereum.org/ JSON API: https://api.destroy.tools/v1/check?domain=wwwethereum.org Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io