# PhishDestroy threat dossier — alhpatrademarket.com ================================================================ Fetched: 2026-07-27 00:18:55 UTC Canonical: https://phishdestroy.io/domain/alhpatrademarket.com/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 84/100 (PhishDestroy scoring — see methodology below) Targeted brand: across (and: ethereum, google) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 15/95 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, ESET, Fortinet, G-Data, Kaspersky, Lionic, Netcraft, Seclookup, SOCRadar, Sophos, VIPRE AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist Victim re-reports (public form): 1 ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 198.251.89.220 (US, Cheyenne) ASN: ASAS53667 PONYNET, US Hosting org: AS53667 FranTech Solutions Registrar: Global Domain Group LLC Nameservers: NS1.MY-CONTROL-PANEL.COM, NS28.ASURAHOSTING.COM Registered: 2025-05-30 Expires: 2026-05-30 Page title: Home -Alhpatrademarket ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-04-29 Status: INVALID chain Fingerprint: 0707186b9c48b720f4183b941120b7dd6a01b81555e3b29fe5f0795814c2199a Subject Alternative Names (related infrastructure — often same operator): - autodiscover.alhpatrademarket.com - cpanel.alhpatrademarket.com - cpcalendars.alhpatrademarket.com - cpcontacts.alhpatrademarket.com - mail.alhpatrademarket.com - webdisk.alhpatrademarket.com - webmail.alhpatrademarket.com - www.alhpatrademarket.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: REPORTS FILED. Domain eventually taken down after 2 abuse notice(s). Reports filed: 2 independent abuse notifications First report: 2026-01-28 07:31:37 UTC Latest report: 2026-03-22 16:34:57 UTC Days since first notice: 179 (eventually taken down) ICANN Compliance CC'd on at least one escalation — non-response is on record. Methodology: follow-up reports are sent ONLY when a victim re-submitted a re-report via our public form, our monitoring detected the domain resurfacing in SEO/feeds, OR our live-checker confirmed the domain is still technically active and fraudulent. Each report contains: VT verdict, URLScan snapshot, WHOIS, SSL metadata, IP/hosting chain, impersonated-brand evidence, drainer/kit classification, screenshots, and a cryptographic hash of the forensic PDF. ICANN RAA Sec. 3.18 applies. Per-report timeline: https://phishdestroy.io/domain/alhpatrademarket.com/#coordinated-suppression ## TIMELINE ---------------------------------------------------------------- Domain registered: 2025-05-30 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-02-25 02:39:27 UTC (by PhishDestroy tracker) First reported: 2026-01-28 07:31:39 UTC (abuse notice filed) Last verified: 2026-07-26 20:21:50 UTC Neutralised: 2026-05-11 19:51:04 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019870be-524b-7684-8436-3ae43e9ef591/ Wayback Machine: https://web.archive.org/web/*/alhpatrademarket.com crt.sh CT logs: https://crt.sh/?q=%25.alhpatrademarket.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=alhpatrademarket.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/alhpatrademarket.com URLhaus: https://urlhaus.abuse.ch/host/alhpatrademarket.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-07 21:49:16 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] alhpatrademarket.com Phishing Intelligence Report - PhishDestroy The website alhpatrademarket.com presents itself with the title "Home -Alhpatrademarket" and impersonates the brand "across", indicating a likely phishing or brand abuse scam. The threat it poses is credential theft or unauthorized data collection by deceiving users into believing they are interacting with a legitimate across-brand service. Technical evidence shows the site was flagged by 15 out of 95 VirusTotal vendors, including ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, and ESET. It is hosted on IP 198.251.89.220 (US) under AS53667 FranTech Solutions, registered through Global Domain Group LLC, and created on 2025-05-30. The SSL certificate is issued by Let's Encrypt (R13), and nameservers are NS1.MY-CONTROL-PANEL.COM and NS28.ASURAHOSTING.COM. As of the report, the site status is DOWN/OFFLINE. Risk assessment tools rate it extremely low: GridinSoft trust at 0/100, ScamAdviser trust at 1/100, and a DOM risk score of 10. The overall risk level is critical due to high detection rates, brand impersonation, and very low trust scores. [Updates since narrative was generated:] - VirusTotal detections: now 15/95 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-1769585422-alhpatrademarke TLS cert SHA-256: 0707186b9c48b720f4183b941120b7dd6a01b81555e3b29fe5f0795814c2199a ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/alhpatrademarket.com/ JSON API: https://api.destroy.tools/v1/check?domain=alhpatrademarket.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 200,667 domains (87,804 alive under monitoring, 111,832 confirmed takedowns/dead). Site: https://phishdestroy.io