VirusTotal
8 / 91
“1 new message”
Security analysis of www.elonmuskgiveaway.org covers observed phishing indicators, infrastructure evidence, current status, and defensive guidance.
Докладний аналіз PhishDestroy AI нижче залишено англійською, щоб зберегти оригінальний криміналістичний запис.
8 / 91
3 community references
Повідомитиprovider verdict: clean
Повідомитизбережений звіт
Повідомити Аналіз завершено
ПовідомитиChecked; no threat flag recorded
ПовідомитиThe domain www.elonmuskgiveaway.org is currently active and has been classified as a brand‑impersonation campaign targeting the celer brand with a crypto‑giveaway narrative. Technical fingerprinting shows the site is hosted on Vercel infrastructure, uses HSTS, and presents a valid TLS certificate issued by Let’s Encrypt (R13). DNS resolution points to IP address 64.29.17.1, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The domain was registered through Tucows Domains Inc. on April 23, 2025, and the HTTP response code is 200, indicating the page is reachable.
The only visible page title returned is "1 new message," and the site’s trust score from Gridinsoft is 0 / 100, a strong indicator of malicious intent. VirusTotal analysis recorded detections from four of ninety‑three scanning engines, and the domain is listed on a single security blocklist. It is also blocked by the PhishDestroy service and appears in three AlienVault OTX threat pulses, reinforcing the consensus that the infrastructure is being leveraged for a crypto‑scam.
While the exact phishing kit or payload has not been publicly disclosed, the combination of a brand‑impersonation label, crypto‑giveaway theme, low trust score, and multiple vendor detections suggests a high‑risk profile. Defenders should immediately add www.elonmuskgiveaway.org to web‑filter deny lists, monitor outbound DNS queries for the associated Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com), and enforce TLS inspection to capture any malicious payloads that may be delivered over the encrypted channel. Continuous threat‑intel feeds should be consulted for any updates on additional indicators of compromise linked to the IP address or the Let’s Encrypt certificate, and incident response teams should be prepared to investigate any user reports of unsolicited messages referencing the "1 new message" title.
Збережені дані спостережень за взаємодією веб-сканера та браузера для цього хоста, а також перевірка відбитків у режимі реального часу для систем розподілу трафіку типу «Кейтаро».
Примітка щодо сканера: unavailable: raw=connection_error; http=0; via=http_proxy; error=SOCKSHTTPConnectionPool(host='duplicate-disabled-43476.invalid', port=80): Max retries exceeded with url: / (Caused by N
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Репутація Edge-IP не пов’язана з цим доменом.
ns1.vercel-dns.comns2.vercel-dns.comLocation describes the IP network.
3b710af7deb73b57fb1510b41f15cd48d73373a0f1b077e1158fb8d3d8fe7176elonmuskgiveaway.orgSaved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Google PageSpeed Insights — mobile performance audit of duplicate-disabled-43476.invalid · checked Mar 2, 2026
13 recorded events. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
Capture the rendered page, requests and visible infrastructure.
Compare the available engine results and retain the analysis timestamp.
Check whether Google currently lists the URL as unsafe.
Inspect a public scan and its recorded network and classification data.
Look for indicator references and related community intelligence.
Compare archived captures and preserve historical context.
Look for matching indicators and associated threat records.
Inspect certificate records and related hostnames.
Compare security resolver responses and record observed blocking.
Inspect the public DNS, TLS, HTTP and technology surface.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
Якщо ви ввели облікові дані облікового запису, особисту чи платіжну інформацію або завантажили файл із цього домену, негайно вживіть заходів. Нижче наведено ресурси, які допоможуть вам повідомити про інцидент і захистити себе.
Виберіть свою країну, щоб отримати офіційні контакти кіберзлочинців або створити проект скарги →.
Template-based draft · optional AI wording assistance requires separate consent
Аналіз загроз за допомогою збереженого списку блокувань, WHOIS, DNS і загальнодоступних доказів сканування
Сканувати заразДодавайте підозрілі домени до нашої бази даних загроз — захищайте спільноту
ПовідомитиОстанні звіти про фішинг і помічені зміни доступності
ВідстежуватиСлідкуйте за актуальними загрозами або оскаржте цей запис, якщо вважаєте, що це помилкова тривога