ABUSE NOTICE · 7D+ OPEN Outgoing abuse reports are recorded; the latest stored availability evidence still shows the domain reachable.
Notification and current-status evidence
The sent-report ledger records the first outgoing report at . The recorded recipient is abuse@godaddy.com. The latest stored availability evidence still shows the domain reachable; 16 days has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
marryingmybestfriend.com is an impersonation phishing page that presents itself under the title "Marrying My Bestfriend - Marrying My Bestfriend." The page title suggests a personal wedding site, while PhishDestroy classifies the domain as impersonation phishing. PhishDestroy first flagged it on 2026-10-08. On 2026-10-19 the site was still online and serving live content.
How the scam works
Impersonation pages borrow the look or identity of something a visitor already trusts. That trust lowers the visitor's guard. A friendly, personal-looking front such as a wedding page makes an unexpected request feel harmless. The request might be to log in to view photos, confirm an RSVP, or follow a link to a supposed partner service. Whatever the visitor types into those prompts goes to the operators. Account passwords, email access or personal details then become the starting point for account takeover and further fraud.
Evidence
Nine of 92 VirusTotal engines flagged the domain in the 2026-10-08 scan. Flagging vendors include alphaMountain.ai, BitDefender, CRDF, Forcepoint ThreatSeeker, G-Data, Google Safe Browsing, Gridinsoft and MalwareURL. Google Safe Browsing labels it SOCIAL_ENGINEERING, Google's category for deceptive pages that trick users into handing over information. Mainstream browsers may therefore warn visitors. The domain appears in five AlienVault OTX threat pulses, so other researchers have tracked it independently. It is also listed on the PhishDestroy blocklist.
Infrastructure
The domain was registered through GoDaddy.com, LLC on 2026-06-11, about four months before PhishDestroy detected it. That gap means the name sat quietly for a while before the malicious activity was spotted. The site resolves to an address on the Cloudflare London, LLC network, geolocated to the US. Because Cloudflare fronts the real origin server, the hosting provider behind the site is hidden. Its TLS certificate comes from Google Trust Services (WE1), a common default for Cloudflare-proxied sites, so the padlock says nothing about legitimacy.
What to do
If you visited the site and entered a username or password, change that password immediately. Also change it anywhere else you reused it, and turn on two-factor authentication on the affected accounts. Check your email and other key accounts for unfamiliar logins, new forwarding rules or recovery changes. Treat any follow-up message that references this "wedding" page as part of the scam. Defenders should block the domain at DNS and web proxy level instead of by IP, since the address is a shared Cloudflare range. They can also add the domain to mail filters and report any links to it found in inbound messages.
Evidence layersAvailability: Content servingContent: Content served at rootDNS: ResolvedRegistration: Unknown
Latest HTTP observation内容在线Ordinary HTTP content served90%2026-10-24 10:34:06 UTC
RDAP registration未知
Observed timelinelast reachable: 2026-10-24 10:34:06 UTClast content: 2026-10-24 10:34:06 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
Recorded subdomains3
Hostnames retained in the domain record or Certificate Transparency cache. A hostname alone does not establish current availability or malicious activity.
pay.marryingmybestfriend.comDomain record
www.marryingmybestfriend.comDomain record
www.pay.marryingmybestfriend.comDomain record
The original observation time is not recorded for these hostnames.
技术 · 19 identified
W
WordPress
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.
Google Maps is a web mapping service. It offers satellite imagery, aerial photography, street maps, 360° interactive panoramic views of streets, real-time traffic conditions, and route planning for traveling by foot, car, bicycle and air, or public transportation.
Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.
jQuery Mobile is a HTML5-based user interface system designed to make responsive web sites and apps that are accessible on all smartphone, tablet and desktop devices.
Underscore.js is a JavaScript library which provides utility functions for common programming tasks. It is comparable to features provided by Prototype.js and the Ruby language, but opts for a functional programming design instead of extending object prototypes.
Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.
jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.
(US) 
