sphinxdeclic[.]com

PhishDestroy first observed sphinxdeclic.com on Apr 16, 2026. The captured page title is “La politique sur Tik Tok Étape 1 sur 6”. Stored page analysis classifies the content as credential phishing. Current evidence score: 86/100 (critical).

One source contains a positive finding: DNS security resolvers. DNS security checks returned 5 blocking results across 12 tested policies: Adguard Default, Adguard Family, Control D Adblock, Control D Family, Control D Malware; no observation timestamp was retained. Non-positive and contextual checks: VirusTotal recorded 0 detections among 91 engines on Aug 8, 2026 at 02:09 UTC. The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 06:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. On Apr 16, 2026 at 15:47 UTC, Google Safe Browsing returned no flag; PhishStats returned no feed match. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:42 UTC. The 0/91 VirusTotal snapshot and the positive findings above are conflicting observations from different sources or collection times.

Cloaking was recorded with HTTP 200 on Aug 7, 2026 at 22:23 UTC. The cloaking probe recorded status split conditional delivery at 1/100 on Aug 7, 2026 at 22:23 UTC: alive_content: raw=ok; http=200; via=https_proxy. Registration records for the domain list Gandi SAS as the registrar and Apr 16, 2026 as the creation date. Registration and first observation occurred on the same UTC date. At collection time, the hostname resolved to 217.182.188.209 on AS16276 (OVH SAS). The recorded endpoint location is Roubaix, FR. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Gandi SAS as the certificate issuer with validity through Jan 30, 2027; checked Apr 16, 2026 at 17:00 UTC.

Stored content provides classification context, but only one source contains a positive finding.