bx4395[.]com

bx4395.com entered the PhishDestroy evidence set on Jun 30, 2026. The stored content classification is credential phishing. The assembled evidence scores 100/100 (critical).

Three independent sources are positive: VirusTotal, Cloudflare Radar, and URLQuery. VirusTotal recorded 18 detections among 91 engines: alphaMountain.ai, Chong Lua Dao, Cluster25, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, Lionic, Seclookup, SOCRadar, Sophos, Webroot on Jul 12, 2026 at 15:24 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. URLQuery recorded 2 detections. The evidence is not unanimous. AlienVault OTX listed 4 community pulse references (not vendor detections) on Jul 12, 2026 at 15:25 UTC. The external blocklist snapshot contained no matches on Aug 7, 2026 at 14:20 UTC. Google Safe Browsing returned no flag on Jul 12, 2026 at 15:24 UTC. URLScan completed without a malicious verdict (score 0) on Jul 1, 2026 at 08:14 UTC.

Cloaking was recorded with HTTP 301 on Aug 7, 2026 at 10:08 UTC. Registration records for the domain list Spaceship, Inc. as the registrar and Apr 6, 2026 as the creation date. At collection time, the hostname resolved to 172.67.134.125 on AS13335 (CLOUDFLARENET - Cloudflare, Inc., US). The associated network metadata labels the endpoint as AS13335 Cloudflare, Inc. in San Francisco, US. The stored server header is cloudflare. Captured page title: “welcome！”. DOM analysis completed on Jul 9, 2026 at 02:20 UTC; stored DOM score 100/100. The evidence archive retains 1 visual capture from PhishDestroy. IoC extraction completed on Jul 29, 2026 at 01:57 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Sep 5, 2026.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. Taken together, the page content and independent findings support classifying this hostname as credential phishing.