# PhishDestroy threat dossier — hg56q.com ================================================================ Fetched: 2026-07-28 15:10:34 UTC Canonical: https://phishdestroy.io/domain/hg56q.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 8/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, CRDF, ESET, Forcepoint ThreatSeeker, Fortinet, SOCRadar, Sophos, Webroot AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 82.109.252.123 (GB, City of London) ASN: AS3257 GTT Communications Inc. Hosting org: Core Devices Registrar: NameMart Pte. Ltd. Nameservers: ["ns1.domainnamedns.com", "ns2.domainnamedns.com"] ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-09-21 Status: INVALID chain Fingerprint: d52a826672e01bd432fb2a74e7471439262e882039b98e0942dc21c0f245254b Subject Alternative Names (related infrastructure — often same operator): - 1188xinpujing.com - 777xinpujing.cc - hg0088.team - hg0088.world - hg0099.mom - hg0404.org - hg0799.org - hg09e.com - hg1919.co - hg3434.org - hg361.net - hg448.app - hg54444.net - hg555g.app - hg5588j.com ... +83 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-26 13:03:07 UTC (by PhishDestroy tracker) Last verified: 2026-07-28 16:20:25 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-26 13:04:28 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] hg56q.com Phishing Site Detected On July 26, 2026, the domain hg56q.com was observed delivering a generic phishing campaign. The domain is registered through NameMart Pte. Ltd. and resolves to the authoritative name servers ns1.domainnamedns.com and ns2.domainnamedns.com. Public scanning services have recorded an HTTP 200 response, indicating that a web server is actively serving content. The domain appears on a single security blocklist and is listed as blocked by the PhishDestroy feed, confirming that at least one defensive platform has taken mitigation action. VirusTotal analysis shows that eight of ninety‑one scanning engines have raised a detection, suggesting that the site exhibits characteristics commonly associated with phishing or malicious hosting. No additional infrastructure details such as IP address, autonomous system number, geographic location, or SSL certificate information were disclosed in the available intelligence. Likewise, page‑level metadata such as title or targeted brand were not captured, leaving the specific impersonated entity unknown. The limited evidence points to an operational phishing infrastructure that remains active. Defenders should prioritize adding hg56q.com to URL filtering rules, enforce DNS sink‑hole or blocklist entries that include the domain, and monitor network traffic for connections to the identified name servers. Continuous re‑scanning with multi‑engine services is recommended to capture any evolution in detection rates. Organizations should also review any user‑reported incidents that reference hg56q.com, and consider informing end‑users about the presence of an active malicious site that may be used in credential‑ harvesting attempts. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 5ccac7470dd76fc5201d495b62a4dec8 TLS cert SHA-256: d52a826672e01bd432fb2a74e7471439262e882039b98e0942dc21c0f245254b ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/hg56q.com/ JSON API: https://api.destroy.tools/v1/check?domain=hg56q.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 211,405 domains (85,845 alive under monitoring, 124,530 confirmed takedowns/dead). Site: https://phishdestroy.io