dlon10[.]cc

dlon10.cc entered the PhishDestroy evidence set on Jul 6, 2026. The stored content classification is credential phishing. The assembled evidence scores 92/100 (critical).

Two independent sources are positive: VirusTotal and Spamhaus DBL. VirusTotal recorded 9 detections among 91 engines: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, LevelBlue, SOCRadar, Sophos on Jul 19, 2026 at 22:21 UTC. Spamhaus DBL: DBL_SPAM on Jul 19, 2026 at 14:34 UTC. The evidence is not unanimous. AlienVault OTX listed 2 community pulse references (not vendor detections) on Jul 19, 2026 at 22:24 UTC. The external blocklist snapshot contained no matches on Aug 7, 2026 at 14:20 UTC. Google Safe Browsing returned no flag on Jul 19, 2026 at 22:21 UTC.

HTTP 301 was recorded on Aug 7, 2026 at 10:47 UTC. Latest classified outcome: redirect observed; cause http redirect on Aug 7, 2026 at 00:50 UTC. Registration records for the domain list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar. At collection time, the hostname resolved to 193.32.204.5 on AS153622 (Madina IT). The associated network metadata labels the endpoint as Vigilant Cyber in Istanbul, TR. The stored server header is nginx. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Oct 3, 2026; checked Jul 19, 2026 at 11:03 UTC.

Neither a page title nor a landing-page capture is stored. No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. Taken together, the page content and independent findings support classifying this hostname as credential phishing.