# PhishDestroy threat dossier — hot-feya-tashkent.life
================================================================

Fetched:   2026-07-29 05:51:45 UTC
Canonical: https://phishdestroy.io/domain/hot-feya-tashkent.life/

## VERDICT
----------------------------------------------------------------
ACTIVE THREAT — multiple warning signs
Composite threat score: 45/100 (PhishDestroy scoring — see methodology below)

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      0/91 security vendors flagged this domain
Public blocklists: listed on 1 independent blocklist

## INFRASTRUCTURE
----------------------------------------------------------------
IP address:      172.67.133.125 (CA, Toronto)
ASN:             AS13335 Cloudflare, Inc.
Hosting org:     Cloudflare, Inc.
Registrar:       Fewmoretaps OU d/b/a Trustname.com

!!! REGISTRAR INTEGRITY ALERT — Trustname / Fewmoretaps OU !!!
Trustname (IANA #4318) is a shell company declaring EUR 120 annual revenue, 1
employee, negative equity, Belarusian ownership. Explicitly advertises itself as
'bulletproof' in its DNS TXT records. Primary source:
  https://phishdestroy.io/trustname-bulletproof-exposed

Nameservers:     dolly.ns.cloudflare.com, jaziel.ns.cloudflare.com
Registered:      2026-07-23
Expires:         2027-07-23
Page title:      Проститутки Ташкент — анкеты индивидуалок с проверенными фото
HTTP response:   200

## TLS CERTIFICATE
----------------------------------------------------------------
Issuer:     Google Trust Services / WE1
Expires:    2026-10-22
Status:     INVALID chain
Fingerprint: 10f5c1283cfdc4649aa9fd52a82ede2d3f72f8cdbd1e5a999f8c9450bca2e28f

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: pending notification queue. No abuse reports filed yet — this domain is
waiting for the next cycle of our automated abuse-reporter.

## TIMELINE
----------------------------------------------------------------
Domain registered: 2026-07-23 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration)
First detected:    2026-07-28 20:07:29 UTC (by PhishDestroy tracker)
Last verified:     2026-07-29 06:04:22 UTC
Current status:    ACTIVE / observable

## EXTERNAL CORROBORATION (third-party evidence)
----------------------------------------------------------------
URLScan.io:       https://urlscan.io/result/019fa9e9-cc2a-7566-9a19-306780abc0f1/
Wayback Machine:  https://web.archive.org/web/*/hot-feya-tashkent.life
crt.sh CT logs:   https://crt.sh/?q=%25.hot-feya-tashkent.life
Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=hot-feya-tashkent.life
AlienVault OTX:   https://otx.alienvault.com/indicator/domain/hot-feya-tashkent.life
URLhaus:          https://urlhaus.abuse.ch/host/hot-feya-tashkent.life/

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-07-28 20:08:50 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

hot-feya-tashkent.life: Confirmed Phishing Site

This domain, hot-feya-tashkent.life, is flagged as a generic phishing threat and remains active as of July 28, 2026. Registered on July 23, 2026 through Fewmoretaps OU d/b/a Trustname.com, the domain resolves to IP address 172.67.133.125 and uses Cloudflare nameservers (dolly.ns.cloudflare.com and jaziel.ns.cloudflare.com). VirusTotal scanned the domain with 91 vendors, none currently flagging it, though the absence of detections does not confirm safety.

The domain appears on one security blocklist and is blocked by PhishDestroy, indicating active threat intelligence tagging. No specific brand, page title, or scam subcategory has been identified from the available data; the exact content of the site remains unanalysed.

Defenders should treat this domain as a confirmed phishing risk, implement blocks across email and web gateways, and monitor for any changes in detection status or content analysis. Further investigation into the site's actual page content and any associated phishing kits is recommended to refine defensive measures.

## EVIDENCE HASHES
----------------------------------------------------------------
Favicon MD5:       87db1031089b5499fee7cf3efe6c92ec
TLS cert SHA-256:      10f5c1283cfdc4649aa9fd52a82ede2d3f72f8cdbd1e5a999f8c9450bca2e28f

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (operator takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/hot-feya-tashkent.life/
JSON API:          https://api.destroy.tools/v1/check?domain=hot-feya-tashkent.life
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: independent open-source threat-intelligence platform.
Tracked: 192,791 domains (82,932 alive under monitoring, 107,965 confirmed takedowns/dead). Site: https://phishdestroy.io