# PhishDestroy domain threat record: hagerbet.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/hagerbet.net/
Machine-readable companion: https://phishdestroy.io/domain/hagerbet.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-28 02:12:43 UTC
- Last availability or vendor check: 2026-10-28 12:13:30 UTC
- Stored record updated: 2026-10-28 12:13:30 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 137.184.129.205
- Registrar in stored WHOIS data: TuringSign Inc. d/b/a Cosmotown
- Last stored HTTP status: 307
- Registration date in stored WHOIS data: 2025-08-25 17:52:30 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a18055-6266-761d-8d14-1b1065f4c2db/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/hagerbet.net
- Certificate Transparency search: https://crt.sh/?q=%25.hagerbet.net
- Web Archive lookup: https://web.archive.org/web/*/https://hagerbet.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed hagerbet.net as a suspicious domain on 2026-10-28 based on its intake reason citing twelve malicious VirusTotal detections. The recorded page title is "مجمع الحكيم الطبي". An HTTP GET on 2026-10-28 returned status 200 with no cross‑site redirects.

How the scam works
The available detections indicate a generic phishing risk, but the page content observed does not reveal a specific credential‑capture mechanism. Consequently the listing does not confirm any particular scam technique beyond the possibility of deceptive credential harvesting.

Evidence
VirusTotal analysis retrieved on 2026-10-28 (analysis performed 2026-10-23) reported 12 malicious and 3 suspicious detections out of 92 engines, with vendors such as BitDefender, G‑Data, Kaspersky and others labeling it phishing. Google Safe Browsing checked on 2026-10-28 did not flag the domain. URLScan captured two snapshots: on 2026-09-02 the engine verdict was clean, while on 2026-10-28 the machine‑learning engine gave a malicious score of 94 though the overall verdict remained non‑malicious. OTX listed five pulses referencing the domain as of 2026-10-28. PhishDestroy’s internal blocklist marks the domain as suspicious, while external blocklists reported zero hits.

Infrastructure
The domain was registered with TuringSign Inc. d/b/a Cosmotown on 2025-08-25 and expires on 2027-08-25. DNS records point to 137.184.129.205, an address owned by DigitalOcean, LLC in the United States, and the domain uses Let’s Encrypt certificate issued 2026-05-13, valid until 2026-08-11. Open ports observed on the host include 22 (SSH) and 80 (HTTP), and the nameservers are ns1‑ns4.mysecurecloudhost.com.

What to do
If you entered credentials on hagerbet.net, change those passwords immediately and enable multi‑factor authentication where possible while monitoring accounts for unauthorized activity. Defenders should block the domain at network perimeters, log any connections, and keep the domain on threat‑intel feeds for continued monitoring.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a18055-6266-761d-8d14-1b1065f4c2db/
Cloudflare Radar report: https://radar.cloudflare.com/scan/f8963782-c8d3-427e-a294-c6bffefc738f
URLQuery report: https://urlquery.net/report/3704c79a-e9e4-4c38-a10c-702031be8f38
Stored capture screenshot: https://urlscan.io/screenshots/01a18055-6266-761d-8d14-1b1065f4c2db.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/3704c79a-e9e4-4c38-a10c-702031be8f38.png
URLScan screenshot (2026-05-13T21:30:32Z): https://screenshots.phishdestroy.io/us/019e233f-886a-7227-b1fe-7c009f7d7642.png
URLScan capture report: https://urlscan.io/result/019e233f-886a-7227-b1fe-7c009f7d7642/
URLScan screenshot (2026-05-14T08:15:52Z): https://screenshots.phishdestroy.io/us/019e258e-5608-71cd-97ab-14a7e89355e1.png
URLScan capture report: https://urlscan.io/result/019e258e-5608-71cd-97ab-14a7e89355e1/
VirusTotal report: https://www.virustotal.com/gui/domain/hagerbet.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=hagerbet.net
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 03:29:02 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a18055-6266-761d-8d14-1b1065f4c2db.png
  Captured: 2026-10-28 02:29:22 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a18055-6266-761d-8d14-1b1065f4c2db.png
  Captured: 2026-10-28 02:29:22 UTC
  Source report: https://urlscan.io/result/01a18055-6266-761d-8d14-1b1065f4c2db/
- URLScan capture 2: https://urlscan.io/screenshots/01a05fe6-2304-77b9-9e6c-5e78581cb163.png
  Captured: 2026-10-28 02:12:43 UTC
  Source report: https://urlscan.io/result/01a18055-6266-761d-8d14-1b1065f4c2db/
- URLQuery: https://screenshots.phishdestroy.io/uq/3704c79a-e9e4-4c38-a10c-702031be8f38.png
  Source report: https://urlquery.net/report/3704c79a-e9e4-4c38-a10c-702031be8f38
  SHA-256: 7bd481f45051332a8bedc7585ddb0d9d0c77e9c19ece4e0e2bbdf0382c937ef7

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-28T02:55:12Z",
        "uuid": "01a18055-6266-761d-8d14-1b1065f4c2db",
        "scanned_at": "2026-10-28T02:27:31Z",
        "final_url": "http://hagerbet.net/login",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://hagerbet.net/",
                "from": "http://hagerbet.net/",
                "status": 307
            },
            {
                "to": "http://hagerbet.net/",
                "from": "https://hagerbet.net/",
                "status": 307
            },
            {
                "to": "http://hagerbet.net/login",
                "from": "http://hagerbet.net/",
                "status": 307
            }
        ],
        "ip": "137.184.129.205",
        "ips": [
            "137.184.129.205"
        ],
        "asns": [
            "14061"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "0fe1558a824aaf0e68d57fc164c2e9ecf9a0d6c119e03c5a95d6db6661bca1d6",
        "script_hashes": [
            "5a9c3425ec248fd2a135e2d0e66f2a86ee1c095bc90e6774ea974ca515d1dbc6",
            "faf054f0939f7790ef3dd78a4a7e81a0fca3dc5343ae2e2bcd6c1c677f211c5c",
            "ecef01644082298b1d70fad6e1bb92d62763c568408e13a0ad6f7c63f8a5c5c1",
            "7cc0e9cf8161f41dd37033a6d4179813b84a68281c13c028697fbb91ac9f068d",
            "1ed81b98639ed3814a8c613f7f382ec15afe6a1c2acc87240a968a50bab878e0",
            "f98256c7427dd6c58b2cb0f18c5b3afb7b4d2898dafb4f4671dfcf51eb225c3d",
            "e9786b1305894e4119bb9811a816dac9cf576755596dd989ee15b455749fc35e",
            "d99de2d13fcd760006b70a6d5326ac037bd42c34c612d9db30768cf06d0f5465",
            "dea5307c1c6943a84b9530b7255f72fad152908432f0dd6eca258766114bc740"
        ],
        "globals": [
            "__next_f",
            "TURBOPACK",
            "next",
            "__webpack_hash__",
            "_N_E_STYLE_LOAD"
        ],
        "domain_age_days": 2944,
        "apex_age_days": 2944,
        "requests": 23,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 94,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx/1.24.0 (Ubuntu)",
            "content-type": "text/html; charset=utf-8",
            "x-powered-by": "Next.js"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-28T02:27:56Z",
        "uuid": "f8963782-c8d3-427e-a294-c6bffefc738f",
        "scanned_at": "2026-10-28T02:20:57Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T03:26:36Z",
        "analysis_at": "2026-10-23T12:21:41Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 12,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "TuringSign Inc. d/b/a Cosmotown",
        "created": "2025-08-25T19:52:30Z",
        "expires": "2027-08-25T19:52:30Z",
        "updated": "2026-08-18T07:22:38Z",
        "first_seen": "2024-03-05T19:14:17Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.mysecurecloudhost.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.mysecurecloudhost.com"
            },
            {
                "ttl": 7200,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:192.250.229.176 include:spf.mysecurecloudhost.com ~all"
            },
            {
                "ttl": 7200,
                "type": "A",
                "value": "137.184.129.205"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns3.mysecurecloudhost.com"
            },
            {
                "ttl": 7200,
                "type": "MX",
                "value": "hagerbet.net",
                "priority": 0
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "servers.mysecurecloudhost.com",
                "value": "ns1.mysecurecloudhost.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns4.mysecurecloudhost.com"
            }
        ],
        "dns_at": "2026-10-23T12:27:10Z",
        "jarm": "28d28d28d00028d00042d42d000000e1ea2a807a629b496b664cf07ad7c08d",
        "cert": {
            "san": [
                "hagerbet.net"
            ],
            "issuer": "Let's Encrypt / E7",
            "serial": "693369913e09709471049362e7b4a2bd145",
            "sha256": "8b7b20c7fc176b4a6f9bb0fe431c5cae357b64a5d3eae65d3d5c1e29300c0ccf",
            "subject": "hagerbet.net",
            "valid_to": "2026-08-11T13:34:09Z",
            "valid_from": "2026-05-13T13:34:10Z"
        },
        "whois": {
            "registrar": "TuringSign Inc. d/b/a Cosmotown",
            "registrar_iana_id": "1509",
            "registrar_url": "http://www.cosmotown.com",
            "created": "2025-08-25T19:52:30Z",
            "updated": "2026-08-18T07:22:38Z",
            "expires": "2027-08-25T19:52:30Z",
            "status": [
                "clientDeleteProhibited",
                "clientRenewProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "ns1.mysecurecloudhost.com",
                "ns2.mysecurecloudhost.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client renew prohibited",
                "client transfer prohibited",
                "client update prohibited"
            ],
            "events": {
                "last changed": "2026-08-18T07:22:38Z",
                "registration": "2025-08-25T19:52:30Z",
                "registrar expiration": "2027-08-25T19:52:30Z",
                "last update of RDAP database": "2026-10-23T12:27:10Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-28T02:27:07Z",
        "mail_config": {
            "mx": [
                "hagerbet.net"
            ],
            "spf": "v=spf1 +a +mx +ip4:192.250.229.176 include:spf.mysecurecloudhost.com ~all",
            "dkim": [
                "default"
            ],
            "dmarc": true,
            "dkim_bits": 2048,
            "spf_lookups": 5
        },
        "caa_records": {
            "domain": "hagerbet.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2025-02-16T19:51:51Z",
            "first": "2011-10-07T18:00:49Z",
            "changes": 7,
            "days_archived": 13,
            "scans_per_day": 0,
            "avg_page_bytes": 2724
        },
        "ports": {
            "open": [
                22,
                80
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "75.2.118.134",
                    "host": "ns2.mysecurecloudhost.com"
                },
                {
                    "ip": "99.83.147.209",
                    "host": "ns4.mysecurecloudhost.com"
                },
                {
                    "ip": "13.248.158.180",
                    "host": "ns1.mysecurecloudhost.com"
                },
                {
                    "ip": "76.223.26.245",
                    "host": "ns3.mysecurecloudhost.com"
                }
            ],
            "zone": "hagerbet.net"
        },
        "location": {
            "ip": "137.184.129.205",
            "asn": "14061",
            "org": "DigitalOcean, LLC",
            "city": "North Bergen",
            "country": "US"
        },
        "dns": {
            "A": [
                "137.184.129.205"
            ],
            "MX": [
                "{\"exchange\": \"hagerbet.net\", \"priority\": 0}"
            ],
            "NS": [
                "ns3.mysecurecloudhost.com",
                "ns2.mysecurecloudhost.com",
                "ns1.mysecurecloudhost.com",
                "ns4.mysecurecloudhost.com"
            ],
            "SOA": "{\"nsname\": \"ns1.mysecurecloudhost.com\", \"hostmaster\": \"servers.mysecurecloudhost.com\", \"serial\": 2026051007, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}",
            "TXT": [
                "v=spf1 +a +mx +ip4:192.250.229.176 include:spf.mysecurecloudhost.com ~all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "137.184.129.205",
            "family": 4
        },
        "whois": {
            "registrar": "TuringSign Inc. d/b/a Cosmotown",
            "created": "2025-08-25T19:52:30Z",
            "updated": "2026-08-18T07:22:38Z",
            "expires": "2027-08-25T19:52:30Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientRenewProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp",
                "clientUpdateProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.mysecurecloudhost.com",
                "ns2.mysecurecloudhost.com"
            ]
        }
    }
}
```