# PhishDestroy threat dossier — ecocampingmunay.cl ================================================================ Fetched: 2026-07-29 12:29:13 UTC Canonical: https://phishdestroy.io/domain/ecocampingmunay.cl/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 8/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, SOCRadar, VIPRE, Webroot AlienVault OTX: 5 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 162.214.96.231 (US, Provo) ASN: ASAS46606 UNIFIEDLAYER-AS-1 - Unified Layer, US Hosting org: AS46606 Unified Layer Registrar: NIC Chile Nameservers: ns1.huevohost.cl, ns2.huevohost.cl, nsa.huevohost.com, nsa1.huevohost.com Registered: 2024-08-02 Expires: 2026-08-02 Page title: Ecocamping Puntilla Munay | Un lugar encantador en el Río Limarí HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-10-11 Status: INVALID chain Fingerprint: 418607f5f1d7da9a4075e96a1e7f278ce6beb5a024b1cce529b39cb90bc1ba1b Subject Alternative Names (related infrastructure — often same operator): - www.cdn.ecocampingmunay.cl ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2024-08-02 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-18 17:46:44 UTC (by PhishDestroy tracker) Last verified: 2026-07-29 12:20:40 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f75e6-bd80-7238-a6c5-5117ae8c77ae/ Wayback Machine: https://web.archive.org/web/*/ecocampingmunay.cl crt.sh CT logs: https://crt.sh/?q=%25.ecocampingmunay.cl Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=ecocampingmunay.cl AlienVault OTX: https://otx.alienvault.com/indicator/domain/ecocampingmunay.cl URLhaus: https://urlhaus.abuse.ch/host/ecocampingmunay.cl/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-22 15:17:08 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] ecocampingmunay.cl Phishing Site Detected Analysis as of July 22, 2026 indicates that the domain ecocampingmunay.cl is actively hosting a phishing page. The site was registered on August 02, 2024 through NIC Chile and resolves to the IP address 162.214.96.231, which is assigned to AS46606 Unified Layer and geolocated in the United States. The hosting infrastructure uses Apache HTTP Server with PHP and MySQL, and the front‑end is built on WordPress and jQuery, with Google Analytics scripts present. The TLS certificate is issued by Let’s Encrypt (YR2), and the HTTP response returns status code 200. The page title served by the web server reads “Ecocamping Puntilla Munay | Un lugar encantador en el Río Limarí”, confirming the content is presented in Spanish and references a local tourism site, which is typical for credential‑harvesting campaigns targeting Spanish‑speaking users. Threat intelligence reports corroborate the malicious classification. AlienVault OTX lists the domain in five separate pulses, and VirusTotal records five detections out of ninety‑one scanned security vendors. The domain appears on one public blocklist and is currently blocked by the PhishDestroy service, indicating that at least one third‑party anti‑phishing platform has taken mitigation action. The authoritative name servers are ns1.huevohost.cl, ns2.huevohost.cl, nsa.huevohost.com, and nsa1.huevohost.com, all of which resolve to the same IP address, suggesting a single‑point hosting arrangement. While the observable indicators confirm active phishing activity, the specific payload, target credentials, and victim interaction flow have not been publicly disclosed. Consequently, defenders should treat the domain as high‑risk. Recommended mitigations include adding the domain and its resolved IP address to network deny lists, updating web‑proxy and DNS filtering rules, and monitoring for similar WordPress‑based deployments that reference the same name‑server set. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 0f05652858943b8ee20d47677e0b3c99 TLS cert SHA-256: 418607f5f1d7da9a4075e96a1e7f278ce6beb5a024b1cce529b39cb90bc1ba1b ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/ecocampingmunay.cl/ JSON API: https://api.destroy.tools/v1/check?domain=ecocampingmunay.cl Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,406 domains (83,173 alive under monitoring, 109,716 confirmed takedowns/dead). Site: https://phishdestroy.io