# PhishDestroy threat dossier — homol.checkout.subscription.pay2b.net ================================================================ Fetched: 2026-07-29 17:52:38 UTC Canonical: https://phishdestroy.io/domain/homol.checkout.subscription.pay2b.net/ ## VERDICT ---------------------------------------------------------------- HIGH THREAT — malicious activity confirmed Composite threat score: 73/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 199.36.158.100 (US, Mountain View) ASN: AS54113 Fastly, Inc. Hosting org: Google LLC Registrar: Tucows Domains Inc. Nameservers: ["ns-1324.awsdns-37.org", "ns-1829.awsdns-36.co.uk", "ns-322.awsdns-40.com", "ns-736.awsdns-28.net"] Page title: Pay2B - Checkout Subscription HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WR3 Expires: 2026-10-11 Status: INVALID chain Fingerprint: 3c7184247649c97707754c7039e14b13a5163a5218e15bb4c8f81cd76ecc8516 Subject Alternative Names (related infrastructure — often same operator): - account.replen.dev - admin.qa.alpop.com.br - agentgg.dev - alpha-admin.polymathai.co - alpha-mockoa.polymathai.co - alpha-resume.polymathai.co - alpha.polymathai.co - app.bukanwacana.id - app.hpptd.com - app.knowledgemember.com - assessments.coach55.in - auth.google.baitaconteudoplay.com.br - auth.routepov.com - autorolainspect.co.uk - betpoints.prestigeclub.vip ... +84 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-26 13:13:09 UTC (by PhishDestroy tracker) Last verified: 2026-07-29 16:20:27 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-26 13:14:17 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] homol.checkout.subscription.pay2b.net Fake Checkout Alert The domain homol.checkout.subscription.pay2b.net is currently active and has been observed serving HTTP content with a 200 response code. Registration data shows it was allocated through Tucows Domains Inc., and the authoritative name servers are ns-1324.awsdns-37.org, ns-1829.awsdns-36.co.uk, ns-322.awsdns-40.com, and an additional entry that was truncated in the source data. The infrastructure appears to be hosted on Amazon’s DNS service, suggesting use of a cloud‑based hosting environment that can be rapidly provisioned. The domain has been submitted to VirusTotal and examined by 91 antivirus and URL scanning engines; none of the engines have raised a detection at the time of analysis. While the lack of detections does not confirm benign intent, it also indicates that the payload or page content has not yet been catalogued by those vendors. Independent threat‑intelligence feeds have flagged the domain: PhishDestroy lists it as blocked, and it appears on one external security blocklist, reinforcing the assessment that it is being used for malicious purposes. No public SSL certificate information, page title, brand targeting, or content snapshot is available, leaving the exact phishing lure and victim‑targeting strategy uncertain. Defenders should treat the domain as hostile, enforce outbound filtering to prevent connections, and add it to internal blocklists or firewall deny rules. Continuous monitoring of DNS resolution and any future VirusTotal or sandbox submissions is recommended to capture evolving indicators. Organizations that process checkout or subscription traffic should be especially vigilant, as the domain name itself mimics legitimate e‑commerce pathways, increasing the likelihood of credential‑stealing attempts. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 076be76557cda007e2710e6466b0a7bd TLS cert SHA-256: 3c7184247649c97707754c7039e14b13a5163a5218e15bb4c8f81cd76ecc8516 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/homol.checkout.subscription.pay2b.net/ JSON API: https://api.destroy.tools/v1/check?domain=homol.checkout.subscription.pay2b.net Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,499 domains (83,266 alive under monitoring, 109,716 confirmed takedowns/dead). Site: https://phishdestroy.io