Global Domain Group LLC
ChainPatrol
Web-Check 
REGISTRAR NEGLIGENCE · EGREGIOUS
Globaldomaingroup was notified 11 days ago — the threat is still operational.
Why this matters — ICANN RAA §3.18 obligation
On PhishDestroy delivered an evidence-backed abuse report
to abuse@globaldomaingroup.com with VirusTotal detections, urlscan capture, legal violations, and full screenshot evidence.
More than 11 days later, the phishing infrastructure remains reachable
.
Under ICANN RAA §3.18 accredited registrars are contractually obliged to “take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse.” Silence beyond 24 hours after a documented notification with verifiable evidence is not a timing issue — it is a policy decision to let the operation continue. PhishDestroy\'s position: where a registrar fails to act on clear evidence, the registrar has aligned itself with the operator of the scheme and bears co-responsibility for downstream harm caused to victims from the moment of notification onward.
Elapsed since first report
11 days
Reports sent
1
Latest case ID
PD-20260721-0AEBC0
Current status
Serving traffic (alive)
Domain security & threat intelligence
devz[.]
devz[.]live
Analyse phishing et sécurité de devz.live
“Pump”
Threat verdict
Critique
100/100 evidence score
Availability
Dernier actif connu
L'accessibilité actuelle n'est pas vérifiée
Risk signals
Détections VirusTotal : 17/91
Correspondances de la liste de blocage stockée : 3
Usurpation de l'identité de la marque : Pump.fun
Domaine jeune : 18 jours
Dernier actif connu
Résumé du rapport
devz.live : 17 moteurs VirusTotal sur 91 ont signalé ce domaine. Consultez le DNS, le SSL, le bureau d’enregistrement et les listes de blocage.
L’analyse détaillée de PhishDestroy AI reste en anglais afin de préserver le relevé forensique original.
Evidence Summary
CRITIQUE
PhishDestroy first recorded devz.live on Jul 21, 2026. This English evidence brief is rebuilt from the current structured observations stored for the report. The current evidence score, computed from those stored observations, is 100/100.
The latest stored availability state is “Dernier actif connu” on Aug 2, 2026 at 00:15 UTC. No conclusive HTTP response is stored, so current availability remains unverified.
VirusTotal returned 17 detections from 91 scanners in the stored check on Jul 26, 2026 at 04:10 UTC. The independent blocklist snapshot recorded 3 matches (MetaMask, ScamSniffer, SEAL) across 10 configured external sources on Aug 2, 2026 at 00:20 UTC. PhishDestroy's own listing is excluded from that count.
Other stored evidence. Google Safe Browsing stored no positive flag on Jul 21, 2026 at 03:59 UTC. This time-bound result is not evidence of safety. AlienVault OTX stored 0 pulse references on Jul 21, 2026 at 03:59 UTC. OTX pulses are community-intelligence references, not vendor verdicts. The Spamhaus DBL snapshot stored no positive result on Jul 21, 2026 at 04:30 UTC. That result is not evidence of safety. A stored Cloudflare Radar snapshot labels the domain malicious. No source check timestamp is stored for this field. A URLScan capture is stored from Jul 21, 2026 at 03:59 UTC.
Stored context lists registrar Global Domain Group LLC, IP address 104.21.52.92, registration date Jul 14, 2026, apparent target Pump.fun. Except for the registration date, these fields do not share a source timestamp in this report and may change.
Treat these as stored, time-bound observations rather than a live safety guarantee. Source verdicts and reachability can change, and zero or missing vendor matches never prove that a domain is safe. Avoid interacting with the domain while uncertainty remains, and use the appeal process if this report is inaccurate.
VirusTotal
17 det.
URLQuery
2 det.
CF Radar
Malicious
URLScan
Gridinsoft
0/100
Scamadviser
80/100
TLS certificate
Google Trust Services
Âge
18d Very New!
Observed status
Dernier actif connu
DestroyList
Listed
Couverture des données
VirusTotal
17 / 91
URLQuery
2 det.
OTX
no pulses
CF Radar
malicious
URLScan capture
stored report
URLScan verdict
malicious
Blocs DNS
not checked
TLS
valid certificate, 83d
WHOIS
18d old
Screenshot
external capture
Chaîne de redirection
not probed
Gridinsoft
0/100
Scamadviser
80/100
Renseignements sur la sécurité réseau
Processus de réponse aux menaces Pipeline
Discovery
Checks
Reports
Availability
14/15
Découverte et ingestion préventives
Threat Intelligence Checks
Notification Records
Publication et disponibilité
Statut de la liste de blocage publique
Collecte des preuves
Stored Capture
2026-07-21 03:59 UTC
Malicious · 17/91 engines
IP: 104.21.52.92
Global Domain Group LLC
18d old
Google Trust Services
Informations sur les domaines
Domaindevz.live
URLScan Verdict
Malicious
score 100 report ↗
Server / ASN
cloudflare · AS13335 Cloudflare, Inc.
IP Context
Cloudflare shared edge
origin IP hidden
edge-IP reputation is not attributed to this domain
Registrar
Global Domain Group
(US)
(US)
IP Address
104.21.52.92
CDN
Geo
Toronto, CA
Toronto, CANetworkAS13335 · Cloudflare, Inc.
Origin IP is hidden behind a CDN proxy. Reverse-IP on the edge IP returns unrelated tenants — origin discovery requires passive-DNS or CT cross-reference.
RegistrationCréé 14/07/2026 (18d · Very New!) — Expires 14/07/2027
Détails techniquesDNS, SAN SSL, horodatages
Première détection21/07/2026
Nameserversbraelyn.ns.cloudflare.comeoin.ns.cloudflare.com
TLS Fingerprint6c8403e54f27ff81612e3dfc02ad7dc838b9b3be…
Favicon Hash
Case IDPD-20260721-0AEBC0
ICANN OVERSIGHT
Accreditation and RAA context
Accreditation and RAA context
L’ICANN a encaissé. La reddition de comptes n’a pas suivi.
Pour ce gTLD, le bureau d’enregistrement ci-dessus opère dans le cadre d’un contrat avec l’ICANN. L’ICANN perçoit des frais annuels, variables et liés aux transactions, associés aux enregistrements, aux renouvellements et aux transferts.
Accréditation : monétisée. Reddition de comptes : veuillez repasser plus tard.
Puis la magie commence : l’ICANN rédige le RAA §3.18, le bureau d’enregistrement enquête sur les abus au sein de sa propre clientèle, et les victimes fournissent gratuitement les preuves pendant que chaque niveau attend qu’un autre agisse. Si cela rassure les victimes, excellent — la facture a fonctionné.
Une accréditation est un contrat, pas un label de sécurité.
Vérifier les frais de l’ICANN
Lire le RAA §3.18
PHISHDESTROY INVESTIGATIONLe cartel ICANN : 155 M$ pour des contrats bafoués
Recoupement des renseignements sur les menaces · external sources
ScamAdviser
Also Listed
This domain independently appears in ScamAdviser’s public database — confirming cross-platform community consensus on its fraudulent nature.
View on ScamAdviser
Live-fetched via CF worker proxy pool · cached 24h
Technologies · 4 identified
H
HSTS
Security
HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.
www.rfc-editor.org 100% confidence
Cloudflare Browser Insights
Analytics
RUM
Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.
www.cloudflare.com 100% confidence
Cloudflare
CDN
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
www.cloudflare.com 100% confidence
H
HTTP/3
Miscellaneous
HTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web.
httpwg.org 100% confidence
Detected via Cloudflare Radar · Wappalyzer engine
Signaler ce domaine
Envoyez des éléments de preuve et contribuez à protéger les autres
Analyse VirusTotal
17 / 91 security vendors flagged this domain
View on VT
alphaMountain.ai
BitDefender
Certego
CRDF
ESET
Emsisoft
Forcepoint ThreatSeeker
Fortinet
G-Data
Gridinsoft
Kaspersky
Lionic
Netcraft
SOCRadar
Sophos
VIPRE
Webroot
Preuves archivées
Wayback Machine Snapshot
A historical snapshot is available for evidence review
Analyse des performances du site
Google PageSpeed Insights — mobile performance audit of devz.live · checked Jul 21, 2026
91
Good
Performance
FCP
1.65s
First Contentful Paint
LCP
1.95s
Largest Contentful Paint
CLS
0.005
Cumulative Layout Shift
TBT
34ms
Total Blocking Time
SI
8.19s
Speed Index
Powered by Google PageSpeed Insights · Mobile strategy · Scores: 90-100 Good 50-89 Needs Work 0-49 Poor
Données factuelles et rapports externes
Analyse de sécurité
OSINT et renseignement
DNS et réseau
Référencement naturel et nom de domaine
Ce site vous a-t-il affecté ?
Vous n'êtes pas seul(e) et il n'y a pas de quoi avoir honte. Les escrocs sont des criminels rusés qui abusent de la confiance des gens. Signaler ce que vous avez subi est l'arme la plus efficace contre la fraude : votre signalement peut empêcher d'autres personnes d'en être victimes et aider les forces de l'ordre à intervenir. Le silence est le plus grand atout de l'escroc. Casse-le.
If you entered account credentials, personal or payment information, or downloaded a file from this domain, take immediate action. Below are resources to help you report the incident and protect yourself.
Action Fraud
Report fraud and cyber crime in England, Wales and Northern Ireland
Contact centre0300 123 2040
PhishDestroy listing review Not a law-enforcement report
Recours en matière de nom de domaine
Request a review if you own this domain and believe the listing is incorrect
Méfiez-vous des escrocs qui prétendent vous aider à récupérer vos biens ! Criminals may contact victims again while pretending to be investigators, lawyers, or recovery agents. Do not pay upfront fees or share credentials. En savoir plus sur la fraude liée aux aides à la reprise →
Signalez-le à vos autorités locales
Sélectionnez votre pays pour obtenir interlocuteurs officiels en matière de cybercriminalité, or create a complaint draft →
Sélectionnez votre pays...
97-country directory
AI-assisted draft — incident details are processed by the AI provider
Review and submit it yourself
Related Infrastructure & Reports
Content matches 4
Other reports on shared Cloudflare edge 1
These reports resolve to the same shared edge IP. They are useful for report discovery but do not imply common ownership or a shared origin server.
geminiapi.yyyhk.org Same registrar: Global Domain Group 6
x-casino.world 
gooddogshop.click 
coincomms.xyz 
myfortnites.com Pump.fun impersonation 8
These domains also target Pump.fun users. View all Pump.fun threats →
pump.fun-party.xyz Recent threat reports 3
Recently added reports from the PhishDestroy database. These discovery links do not imply shared infrastructure or ownership.
rlcounsel.com About This Report: devz.live
This report presents the latest stored evidence available to PhishDestroy. Source timestamps are shown where available; availability and vendor verdicts can change after collection.
The site displays a page titled “Pump”, which may be designed to impersonate Pump.fun.
devz.live has been flagged by 17 security vendors as of August 2, 2026.
Si vous estimez que cette annonce est inexacte, vous pouvez introduire un recours. Pour plus d'informations sur notre méthodologie, rendez-vous sur notre Page FAQ.
Vérifier n'importe quel domaine
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scanner maintenantSignaler une tentative d'hameçonnage
Signalez les domaines suspects à notre base de données des menaces — protégez la communauté
ReportFlux d'alertes en temps réel
Recent phishing reports and observed availability changes
MonitorRestez informés, restez en sécurité
Surveillez les menaces en temps réel ou signalez cette alerte si vous pensez qu'il s'agit d'un faux positif