b-offer[.]link

b-offer.link entered the PhishDestroy evidence set on Jan 26, 2026. The captured page title is “Welcome!”. Evidence score: 61/100 (elevated).

Positive source (1): VirusTotal. VirusTotal recorded 2 detections among 95 engines: Forcepoint ThreatSeeker, SOCRadar on May 15, 2026 at 23:15 UTC. Other stored checks: The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. URLQuery recorded no positive detection on Jan 26, 2026 at 08:12 UTC. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0) on Jan 26, 2026 at 06:43 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:10 UTC; content was unavailable. Registration records for the domain list 1API GmbH as the registrar. At collection time, the hostname resolved to 45.76.44.251 on AS20473 (The Constant Company, LLC). The associated network metadata labels the endpoint as AS20473 The Constant Company, LLC in Aubervilliers, FR. The stored server header is nginx. DOM analysis completed on Apr 23, 2026 at 03:20 UTC without a scored DOM indicator (0/100); the source-based findings remained positive. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. IoC extraction completed on Aug 2, 2026 at 04:15 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators.

VirusTotal is the only positive source family in the stored checks; the other recorded checks did not corroborate it at their collection times. Stored content fields do not identify a target brand or exact victim interaction.