tivmariq.shop

PhishDestroy first observed tivmariq.shop on Sep 23, 2026. Stored content metadata identifies Unknown as the apparent target. The captured page title is “viphentai.org – viphentai”. Current evidence score: 95/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and Cloudflare Radar. VirusTotal recorded 15 detections among 89 engines: alphaMountain.ai, BitDefender, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, SafeToOpen, Seclookup, SOCRadar, Sophos, VIPRE, Webroot on Sep 23, 2026 at 04:33 UTC. Cloudflare Radar classified the hostname as malicious and assigned the categories security threats and malware; its verdict timestamp was not retained. Non-positive and contextual checks: AlienVault OTX listed 5 community pulse references (not vendor detections) on Sep 23, 2026 at 04:34 UTC. The separate external-blocklist snapshot contained no matches on Sep 23, 2026 at 02:20 UTC. Google Safe Browsing returned no flag on Sep 23, 2026 at 04:33 UTC. URLScan completed without a malicious verdict (score 0) on Sep 23, 2026 at 03:30 UTC.

The collector marked the hostname reachable on Sep 23, 2026 at 01:29 UTC, but did not retain the HTTP response code. At collection time, the hostname resolved to 94.154.172.92 (AS209101 IP Vendetta Inc.). The recorded endpoint location is Utrecht, NL. The stored server header is nginx. DOM analysis on Sep 23, 2026 at 02:20 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 3 visual captures from PhishDestroy and URLScan. IoC extraction on Sep 23, 2026 at 04:00 UTC retained 0 format-validated wallet addresses and 1 Telegram indicator. TLS metadata lists YR2 as the certificate issuer.

The content indicators and 2 positive source findings support the current Unknown impersonation and phishing classification. The target field identifies Unknown, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.