# PhishDestroy threat dossier — h111h.xyz ================================================================ Fetched: 2026-07-30 02:45:02 UTC Canonical: https://phishdestroy.io/domain/h111h.xyz/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 15/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safe Browsing, Gridinsoft, LevelBlue, Lionic, Sophos, VIPRE, Webroot AlienVault OTX: 4 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist Google Safe Browsing: FLAGGED ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 103.244.148.114 (HK, Hong Kong) ASN: AS135357 HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED Hosting org: Shenzhenshihong Technology Development Co., Ltd Registrar: Gname.com Pte. Ltd. Nameservers: ["ns1.1111343.com", "ns2.1111343.com", "ns3.1111343.com", "ns4.1111343.com"] HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-09-14 Status: INVALID chain Fingerprint: 4485b10d93050e04b6290eb51c405377a8af50947b75d9d999cb9bd27a58a161 Subject Alternative Names (related infrastructure — often same operator): - 100031.cc - 100036.cc - 100037.cc - 100038.cc - 100062.cc - 100073.cc - 100079.cc - 100083.cc - 100109.cc - 100156.cc - 13779.xyz - 13791.xyz - 13806.xyz - 13809.xyz - 13824.xyz ... +74 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-26 10:03:09 UTC (by PhishDestroy tracker) Last verified: 2026-07-30 04:20:26 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-26 10:04:45 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] h111h.xyz generic phishing operation Analysis as of July 26 2026 identifies the domain h111h.xyz as an active generic phishing infrastructure. The domain is registered through Gname.com Pte. Ltd. and resolves to four authoritative name servers (ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns4.1111343.com). An HTTP request returns status code 200, indicating that a web service is reachable. The site is currently listed on one public security blocklist and is actively blocked by the PhishDestroy feed. Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal records 15 of 91 scanning engines flagging the domain as malicious. The presence on a single blocklist suggests limited exposure in public feeds, yet the combination of Google Safe Browsing and multiple vendor detections confirms malicious intent. These signals collectively raise the risk rating to high. Publicly available evidence does not include the page title, targeted brand, or the underlying phishing kit, so the exact luring technique remains unconfirmed. No additional intelligence on the hosting IP, ASN, or TLS configuration has been disclosed, and DNS TTL values are not provided, limiting further correlation. Consequently, defenders cannot attribute the infrastructure to a specific campaign beyond the generic phishing label, though the activity may be part of a rotating pool of malicious domains. Mitigation guidance recommends immediate blocking of h111h.xyz at perimeter and endpoint controls, inclusion in internal blocklists, and continuous monitoring for any related DNS or HTTP activity. Security teams should also query additional threat‑intel platforms for updates on the hosting provider or related indicator sets, as the current data set is limited to registrar, DNS, and scanning‑vendor observations. [Updates since narrative was generated:] - Public blocklists: now listed on 1 feed ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 4485b10d93050e04b6290eb51c405377a8af50947b75d9d999cb9bd27a58a161 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/h111h.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=h111h.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,547 domains (93,372 alive under monitoring, 99,913 confirmed takedowns/dead). Site: https://phishdestroy.io