protect[.]sequirtybot[.]cfd

protect.sequirtybot.cfd is a subdomain of sequirtybot.cfd. PhishDestroy first recorded this hostname on Apr 25, 2026. The captured page title is “Telegram: Join Group Chat”. Evidence score: 88/100 (high).

Positive source (1): VirusTotal. VirusTotal recorded 11 detections among 94 engines: ADMINUSLabs, BitDefender, Chong Lua Dao, CRDF, CyRadar, Ermes, Fortinet, G-Data, Lionic, SOCRadar, Sophos on Jun 26, 2026 at 12:14 UTC. Other stored checks: The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. Google Safe Browsing returned no flag on Jun 26, 2026 at 12:14 UTC. URLScan completed without a malicious verdict (score 0). PhishStats returned no feed match on Apr 25, 2026 at 18:07 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:22 UTC; content was unavailable. Registration records for the registrable domain sequirtybot.cfd list Global Domain Group LLC as the registrar and Apr 25, 2026 as the creation date. Registration preceded first observation by 0 days. At collection time, the hostname resolved to 104.21.45.181 on AS13335 (Cloudflare, Inc.). The recorded endpoint location is Toronto, CA. The stored server header is cloudflare. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Aug 1, 2026 at 04:14 UTC; stored 0 format-validated wallet addresses and 1 Telegram indicator. TLS metadata lists Let's Encrypt / E8 as the certificate issuer with validity through Jul 24, 2026; checked Apr 25, 2026 at 20:00 UTC.

VirusTotal is the only positive source family in the stored checks; the other recorded checks did not corroborate it at their collection times. Stored content fields do not identify a target brand or exact victim interaction.