# PhishDestroy threat dossier — hg28281.com ================================================================ Fetched: 2026-07-29 20:57:21 UTC Canonical: https://phishdestroy.io/domain/hg28281.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 98/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain AlienVault OTX: 6 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 87.85.109.108 (DE, Düsseldorf) ASN: AS3257 GTT Communications Inc. Hosting org: GTT - EMEA Ltd Registrar: NameMart Pte. Ltd. Nameservers: ["ns1.domainnamedns.com", "ns2.domainnamedns.com"] ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-09-23 Status: INVALID chain Fingerprint: 7618b2b7e7464e53e2eb05d012b2df19b633f825023da0c4672e588a7559aa33 Subject Alternative Names (related infrastructure — often same operator): - 2hg10.com - 3617yh.com - hg12.net - hg28282.com - hg28283.com - hg28285.com - hg7bet.cc - hg7vip.best - hg7vip.cc - hghg00.com - hgzb65.cc - m.2hg10.com - m.3617yh.com - m.hg12.net - m.hg28281.com ... +41 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-26 12:33:08 UTC (by PhishDestroy tracker) Last verified: 2026-07-29 21:00:35 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-26 12:34:26 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] hg28281.com Safety Check — Phishing Site Detected This domain, hg28281.com, is currently listed on a single security blocklist and is actively blocked by the PhishDestroy filtering service. The domain resolves to the authoritative name servers ns1.domainnamedns.com and ns2.domainnamedns.com, which are typical of generic DNS hosting providers. Registration information shows the registrant as NameMart Pte. Ltd., a registrar frequently observed in malicious infrastructure, though no further ownership details are disclosed. An HTTP GET request to the root URL returns a 200 OK status, indicating that a web server is reachable, but no page title or content analysis is available in the intelligence feed. The domain was submitted to VirusTotal where 91 antivirus engines inspected the site; none reported a detection. While the absence of detections does not confirm benign intent, it suggests that the payload, if any, may be using techniques that evade static signature checks. The domain’s presence on a blocklist and its classification as a generic phishing site constitute the primary actionable indicators. At present, no IP address, geolocation, SSL certificate details, or Safe Browsing/OTX entries are supplied, leaving those vectors unverified. Defenders should continue to block hg28281.com at perimeter and endpoint layers, monitor DNS queries for lookups to the listed name servers, and consider adding the domain to internal blocklists. Ongoing traffic analysis should be employed to detect any attempts to retrieve resources from the site, and any observed payloads should be submitted to sandbox environments for dynamic analysis. Because the infrastructure is sparse, continuous re‑evaluation is advised as additional intelligence, such as payload samples or hosting details, becomes available. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: b6720ddd8f341a304e36b59f8b2f48ee TLS cert SHA-256: 7618b2b7e7464e53e2eb05d012b2df19b633f825023da0c4672e588a7559aa33 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/hg28281.com/ JSON API: https://api.destroy.tools/v1/check?domain=hg28281.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,508 domains (83,275 alive under monitoring, 109,716 confirmed takedowns/dead). Site: https://phishdestroy.io