biodentex.org is on the PhishDestroy blocklist as a suspicious domain. It has not been tied to a specific brand or scam type. PhishDestroy first saw it on 2026-08-27. The site went offline on 2026-09-17 and was still dead with no reachable content when last checked on 2026-10-19.
How the scam works
No page title, impersonated brand or phishing kit has been linked to this domain, so we cannot name the exact scheme it ran. The available evidence points to a domain that served harmful or deceptive content to visitors. Typical risks with such pages are fake login or payment forms and lures that ask for sensitive details. The site was live for about three weeks before going dark, which fits a short-lived campaign that is dropped once it starts being flagged.
Evidence
On 2026-09-18, VirusTotal showed 5 of 89 engines flagging the domain: alphaMountain.ai, CRDF, ESET, Forcepoint ThreatSeeker and SOCRadar. That is a modest count, but these are independent sources that agree, including a major antivirus vendor and several threat-intelligence feeds. The domain also appears in 3 AlienVault OTX pulses, so other researchers have tracked it as part of malicious activity. Among blocklists, PhishDestroy is the only one listing it so far.
Infrastructure
The domain was registered through Spaceship, Inc. Its address, 185.203.72.51, sits on the Variti+ LLC network in the United Kingdom. The certificate came from Let's Encrypt, so the browser padlock only meant the connection was encrypted. It said nothing about whether the site could be trusted. The VirusTotal check came one day after the site went offline, so most detections arrived late in its short lifespan.
What to do
If you opened a link to biodentex.org, do not return to it, and delete any messages that pointed you there. If you typed a password into the site, change it everywhere you use it and turn on two-factor authentication. If you entered card or banking details, contact your bank to block the card and dispute any unfamiliar charges. Security teams should block the domain and 185.203.72.51, and check proxy and DNS logs for traffic to either from 2026-08-27 onward.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
This report concerns an automated cryptocurrency laundering machine on the Polygon network that is used by the operators of an active macOS malware (stealer) campaign.
CONTEXT The malware campaign delivers a macOS stealer via fake "CipherCheck — I'm not a robot" verification p
Check for cloaking
Compare what a browser and a crawler receive, and check for Keitaro traffic routing.
1 report filed for biodentex.org (1 written by a person) · category: Other Hack · source checked
“This report concerns an automated cryptocurrency laundering machine on the Polygon network that is used by the operators of an active macOS malware (stealer) campaign.
CONTEXT The malware campaign delivers a macOS stealer via fake "CipherCheck — I'm not a robot" verification pages. Victims are tricked into pasting a base64-encoded command into Terminal, which installs a persistent LaunchAgent and pulls a second-stage payload from a Polygon smart contract used as a C2 directory (contract 0xA3a”
— reported by Anonymous on Aug 27, 2026 · Source: ChainAbuse (TRM Labs) — full report and evidence there.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
