# PhishDestroy threat dossier — hotspot.ynriver.com ================================================================ Fetched: 2026-07-30 10:53:55 UTC Canonical: https://phishdestroy.io/domain/hotspot.ynriver.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 83/100 (PhishDestroy scoring — see methodology below) Scam classification: Credential Phishing ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 151.101.1.195 (CA, Montreal) ASN: AS54113 Fastly, Inc. Hosting org: Fastly, Inc. Registrar: HOSTINGER operations, UAB Nameservers: ["ns1.dns-parking.com", "ns2.dns-parking.com"] Page title: HOTSPOT HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WR3 Expires: 2026-10-06 Status: INVALID chain Fingerprint: ab08e2d47a7aa3c2b1fdbd2929ce74be19ccfc8105a583ee8b7334990bd4bb7c Subject Alternative Names (related infrastructure — often same operator): - app.clexx.ch - app.filmfuse.com - appstage.swell.life - archeus.seelay.in - artman.io - auth.steer.coach - av.ant-gar.de - boost.thndr.io - cn.freebtc.it - crudetech.se - cvpar-capital.qitech.digital - dooboo.io - dyn.conservative.blabber.buzz - everyloop.in - family.siddarth.xyz ... +84 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-26 14:13:09 UTC (by PhishDestroy tracker) Last verified: 2026-07-30 12:20:30 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-26 14:14:30 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] hotspot.ynriver.com phishing site impersonates login portals – Analysis conducted on July 26, 2026 identifies hotspot.ynriver.com as an active phishing domain targeting login credentials. The domain is registered through HOSTINGER operations, UAB, and resolves to nameservers ns1.dns-parking.com and ns2.dns-parking.com, a pattern commonly observed in low-cost, disposable hosting setups. At the time of assessment, the site returns an HTTP 200 status, indicating an operational web server, though the specific content and targeted brand remain unconfirmed due to limited forensic analysis. Infrastructure checks reveal the domain appears on a single security blocklist, suggesting early-stage detection by at least one vendor. No detections were recorded among the 91 security vendors that scanned the domain via VirusTotal, though this absence does not confirm legitimacy. The registrar, HOSTINGER operations, UAB, is frequently utilized for both legitimate and malicious registrations, providing no definitive classification on its own. Defenders are advised to treat hotspot.ynriver.com as a high-potential threat vector. Network-level blocking is recommended, particularly for organizations with users likely to encounter credential-harvesting pages. Continuous monitoring for additional detections or shifts in hosting infrastructure is warranted, as phishing domains often migrate or resurface under altered configurations. Further analysis of the site’s content, if accessible, would clarify the exact phishing kit or targeted service, but such examination has not yet been completed. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 8e42aa2b0f93dcab9480b8e0a5d17ddb TLS cert SHA-256: ab08e2d47a7aa3c2b1fdbd2929ce74be19ccfc8105a583ee8b7334990bd4bb7c ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/hotspot.ynriver.com/ JSON API: https://api.destroy.tools/v1/check?domain=hotspot.ynriver.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,594 domains (84,496 alive under monitoring, 108,837 confirmed takedowns/dead). Site: https://phishdestroy.io