# PhishDestroy threat dossier — hogardelnino.com
================================================================

Fetched:   2026-06-29 05:33:29 UTC
Canonical: https://phishdestroy.io/domain/hogardelnino.com/

## VERDICT
----------------------------------------------------------------
CRITICAL THREAT — DO NOT VISIT
Composite threat score: 100/100 (PhishDestroy scoring — see methodology below)

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      1/91 security vendors flagged this domain
  Flagging vendors: ChainPatrol
Public blocklists: listed on 3 independent blocklists

## INFRASTRUCTURE
----------------------------------------------------------------
IP address:      188.114.96.3 (US, San Francisco)
ASN:             AS13335 Cloudflare, Inc.
Hosting org:     AS13335 Cloudflare, Inc.
Registrar:       NAMECHEAP INC
Nameservers:     aspen.ns.cloudflare.com, augustus.ns.cloudflare.com
Registered:      2025-10-16
Expires:         2026-10-16
Page title:      Juancito Sport – Béisbol, Baloncesto y Casino Online RD
HTTP response:   530

## TLS CERTIFICATE
----------------------------------------------------------------
Issuer:     Let's Encrypt / E7
Expires:    2026-07-29
Status:     INVALID chain
Fingerprint: 4f03c6ae81de14f1bfdc6bf0dd03d31cf368ee7f1b50fd73809e3f7494ec6dd2

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: pending notification queue. No abuse reports filed yet — this domain is
waiting for the next cycle of our automated abuse-reporter.

## TIMELINE
----------------------------------------------------------------
Domain registered: 2025-10-16 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration)
First detected:    2026-06-27 00:07:31 UTC (by PhishDestroy tracker)
First reported:    2026-06-26 22:09:19 UTC (abuse notice filed)
Last verified:     2026-06-29 06:17:15 UTC
Current status:    ACTIVE / observable

## EXTERNAL CORROBORATION (third-party evidence)
----------------------------------------------------------------
URLScan.io:       https://urlscan.io/result/019f05f8-705a-74b8-bda9-e34a0ea68d45/
URLQuery:         https://urlquery.net/report/4487643b-90df-4856-8e2d-2d5a70e2f751
Wayback Machine:  https://web.archive.org/web/*/hogardelnino.com
crt.sh CT logs:   https://crt.sh/?q=%25.hogardelnino.com
Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=hogardelnino.com
AlienVault OTX:   https://otx.alienvault.com/indicator/domain/hogardelnino.com
URLhaus:          https://urlhaus.abuse.ch/host/hogardelnino.com/

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-06-27 00:23:04 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

Analysis indicates hogardelnino.com presents a high-risk generic phishing threat. The domain actively hosts deceptive content designed to capture credentials or deploy malware through fraudulent interfaces.

Infrastructure analysis reveals exact indicators including VirusTotal detection at 1/95 security vendors, IP resolution to 188.114.96.3, SSL certificate issued by Let's Encrypt, registration via NAMECHEAP INC, presence on 3 security blocklists, blocking by PhishDestroy MetaMask and SEAL, creation date of October 16 2025, and Gridinsoft trust score of 0/100. The domain remains active with no observed changes in hosting configuration.

Technical mitigation requires blocking all traffic to hogardelnino.com at network and endpoint levels. Users must avoid entering any credentials or personal data on matching URLs and instead verify legitimate sites through official channels. Organizations should update firewall rules and browser policies to prevent resolution of this domain while monitoring for similar registrations sharing the same IP range or registrar patterns.

[Updates since narrative was generated:]
  - VirusTotal detections: now 1/91 (narrative was written when count was lower)

## EVIDENCE HASHES
----------------------------------------------------------------
PhishDestroy Case ID:  PD-20260626-66494F
Favicon MD5:       59b9b520b7f64be900e658a5b0b50b1a
TLS cert SHA-256:      4f03c6ae81de14f1bfdc6bf0dd03d31cf368ee7f1b50fd73809e3f7494ec6dd2

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (volunteer takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/hogardelnino.com/
JSON API:          https://api.destroy.tools/v1/check?domain=hogardelnino.com
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: volunteer-driven open-source threat-intelligence platform.
Tracked: 172,288 domains (13,596 alive under monitoring, 158,144 confirmed takedowns/dead). Site: https://phishdestroy.io