# PhishDestroy threat dossier — homies-bbq.uz ================================================================ Fetched: 2026-07-31 22:30:06 UTC Canonical: https://phishdestroy.io/domain/homies-bbq.uz/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 93/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 5/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 176.57.65.206 (RU, Moscow) ASN: AS57724 DDOS-GUARD LTD Hosting org: Inv2 Registrar: SUVAN NET Nameservers: not.defined., , rdns1.ahost.uz, rdns1.ahost.uz., 185.196.212.52, rdns2.ahost.uz, rdns2.ahost.uz. Registered: 2024-08-12 Expires: 2026-08-13 Page title: Homies BBQ — техасский брискет в Ташкенте. Доставка HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-07-27 Status: INVALID chain Fingerprint: 6098315dd7813c5c678fd7ac1544918d45f04a628d3c52e442526ebcf19bc01f ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2024-08-12 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-17 11:17:12 UTC (by PhishDestroy tracker) Last verified: 2026-08-01 00:18:17 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f6f5c-31f2-7685-9eca-e3fbd6969dd5/ Wayback Machine: https://web.archive.org/web/*/homies-bbq.uz crt.sh CT logs: https://crt.sh/?q=%25.homies-bbq.uz Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=homies-bbq.uz AlienVault OTX: https://otx.alienvault.com/indicator/domain/homies-bbq.uz URLhaus: https://urlhaus.abuse.ch/host/homies-bbq.uz/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-17 11:20:17 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] homies-bbq.uz Phishing Infrastructure – Active This domain homies-bbq.uz was registered on 12 August 2024 through SUVAN NET. It resolves to the IPv4 address 176.57.65.206 and is served by the name servers rdns1.ahost.uz (185.196.212.52) and rdns2.ahos (truncated). The domain is currently marked as active and has been classified as generic_phishing, with a risk level of under_investigation. VirusTotal reports indicate that the domain was scanned by 91 security vendors; none of the scanners raised a detection at the time of analysis, but the absence of a detection does not confirm benign behavior. No public content, page title, or landing page analysis is available, so the exact phishing payload or targeted brand cannot be confirmed. Infrastructure analysis shows that the hosting IP belongs to a range often associated with hosting providers in Central Asia, but attribution beyond the registrar is not established. Defenders should block DNS resolution for homies-bbq.uz, monitor outbound connections to 176.57.65.206, and include the domain in email gateway deny lists. Continuous monitoring is advised to detect any future changes such as new file uploads, altered DNS records, or emergence of malicious payloads. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 3838a7d4175e1cb28bb23523d5a13e8f TLS cert SHA-256: 6098315dd7813c5c678fd7ac1544918d45f04a628d3c52e442526ebcf19bc01f ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/homies-bbq.uz/ JSON API: https://api.destroy.tools/v1/check?domain=homies-bbq.uz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 196,335 domains (84,056 alive under monitoring, 27,268 confirmed neutralized). Site: https://phishdestroy.io