# PhishDestroy threat dossier — hga750.com
================================================================

Fetched:   2026-07-02 23:40:00 UTC
Canonical: https://phishdestroy.io/domain/hga750.com/

## VERDICT
----------------------------------------------------------------
TAKEN DOWN (neutralised)
Composite threat score: 64/100 (PhishDestroy scoring — see methodology below)

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      17/91 security vendors flagged this domain
  Flagging vendors: alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, ESET, Emsisoft, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Netcraft, OpenPhish, SOCRadar, Sophos, Webroot
URLQuery:        4 detections
Public blocklists: listed on 1 independent blocklist

## INFRASTRUCTURE
----------------------------------------------------------------
IP address:      20.247.100.105 (HK, Tung Chung)
ASN:             ASAS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US
Hosting org:     AS153656 OWGELS INTERNATIONAL CO., LIMITED
Registrar:       Gname.com Pte. Ltd.
Nameservers:     a.share-dns.com, a4.share-dns.com, b.share-dns.net, b4.share-dns.net
Registered:      2025-05-06
Expires:         2027-05-06
Page title:      bet365

## TLS CERTIFICATE
----------------------------------------------------------------
Issuer:     Let's Encrypt / YR1
Expires:    2026-09-25
Status:     INVALID chain
Fingerprint: 26a3d373c3bde6897d90ce89a3c6363a5620d5e45773d666d8d4fa042d0a2119
Subject Alternative Names (related infrastructure — often same operator):
  - www.hga750.com

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: CLOSED — no report required.
This domain was neutralised before the abuse-report cycle could be dispatched — either
the hosting provider / registrar suspended it on their own, the DNS went dead, or the
operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file
for audit but no formal notice was sent.

## TIMELINE
----------------------------------------------------------------
Domain registered: 2025-05-06 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration)
First detected:    2026-07-01 02:28:04 UTC (by PhishDestroy tracker)
First reported:    2026-07-01 00:44:24 UTC (abuse notice filed)
Last verified:     2026-07-03 00:20:37 UTC
Neutralised:       2026-07-01 03:03:12 UTC
Current status:    taken down (registrar suspended or DNS dead)

## EXTERNAL CORROBORATION (third-party evidence)
----------------------------------------------------------------
URLScan.io:       https://urlscan.io/result/019f1b11-f15e-72db-94f9-6dd8c79b68cb/
URLQuery:         https://urlquery.net/report/07fb689f-3305-4427-9856-85978aaa1f7d
Wayback Machine:  https://web.archive.org/web/*/hga750.com
crt.sh CT logs:   https://crt.sh/?q=%25.hga750.com
Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=hga750.com
AlienVault OTX:   https://otx.alienvault.com/indicator/domain/hga750.com
URLhaus:          https://urlhaus.abuse.ch/host/hga750.com/

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-07-01 02:46:22 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

This domain is flagged as a high-risk credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the infrastructure is designed to mimic legitimate services, tricking victims into submitting usernames, passwords, or financial details. The threat type, classified as generic_phishing, aligns with campaigns observed in recent months where attackers exploit trusted-looking domains to bypass initial user scrutiny.  Infrastructure analysis reveals the domain hga750.com was registered on May 06, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with newly created phishing domains. It currently resolves to the IP address 103.163.208.152, a host with a history of supporting malicious activity. The domain’s SSL certificate, issued by Let’s Encrypt, provides HTTPS encryption, which may falsely reassure users despite its fraudulent intent. Detection metrics from aggregated threat intelligence sources report 15 out of 95 security vendors have flagged this domain, with several blocklists and reputation systems categorizing it as malicious. No trust scores or benign classifications have been recorded, reinforcing its high-risk status.  To mitigate the risk posed by hga750.com, users should immediately block the domain at the network or endpoint level using firewall rules or security policies. Organizations are advised to deploy email filtering solutions capable of identifying and quarantining messages containing links to this domain. End users should be educated to recognize phishing indicators, such as unexpected login prompts, mismatched URLs, or requests for sensitive information. If credentials have already been entered on this site, affected accounts should be secured by resetting passwords and enabling multi-factor authentication. Monitoring for unauthorized access or unusual activity is strongly recommended.

## EVIDENCE HASHES
----------------------------------------------------------------
PhishDestroy Case ID:  PD-20260701-9F441A
Favicon MD5:       e9510244308a4684d6c0b461494353e0
TLS cert SHA-256:      26a3d373c3bde6897d90ce89a3c6363a5620d5e45773d666d8d4fa042d0a2119

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (operator takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/hga750.com/
JSON API:          https://api.destroy.tools/v1/check?domain=hga750.com
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: independent open-source threat-intelligence platform.
Tracked: 174,015 domains (14,079 alive under monitoring, 159,195 confirmed takedowns/dead). Site: https://phishdestroy.io