# PhishDestroy threat dossier — hyperinteract.com ================================================================ Fetched: 2026-06-28 08:43:47 UTC Canonical: https://phishdestroy.io/domain/hyperinteract.com/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: redirect_split) (score: 5/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 18/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, Chong Lua Dao, Cluster25, CyRadar, ESET, Emsisoft, Fortinet, Google Safebrowsing, Gridinsoft, Lionic, MalwareURL, Netcraft, SOCRadar, Sophos, URLQuery, VIPRE, Webroot AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist Google Safe Browsing: FLAGGED ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 107.180.115.116 (US, Phoenix) ASN: ASAS26496 AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US Hosting org: AS26496 GoDaddy.com, LLC Registrar: GoDaddy.com, LLC Nameservers: ns41.domaincontrol.com, ns42.domaincontrol.com Registered: 2014-03-31 Expires: 2029-03-31 Page title: Webmail - Login HTTP response: 200 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2014-03-31 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-27 02:10:38 UTC (by PhishDestroy tracker) First reported: 2026-06-27 00:12:52 UTC (abuse notice filed) Last verified: 2026-06-28 10:40:27 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f0669-46e9-7193-8eb9-80927335afd2/ URLQuery: https://urlquery.net/report/d06611e0-8da2-4db7-953b-98dc9e33ff1f Wayback Machine: https://web.archive.org/web/*/hyperinteract.com crt.sh CT logs: https://crt.sh/?q=%25.hyperinteract.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=hyperinteract.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/hyperinteract.com URLhaus: https://urlhaus.abuse.ch/host/hyperinteract.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-27 02:21:00 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, hyperinteract.com, is currently flagged as an active generic phishing threat specializing in fake loading page schemes designed to execute social engineering attacks. Analysis indicates the domain does not impersonate a specific brand but instead leverages a deceptive 'Loading...' page title to manipulate users into disclosing sensitive information or downloading malicious payloads. The domain remains operational and poses a high risk to unsuspecting visitors. Infrastructure analysis reveals hyperinteract.com was registered through GoDaddy.com, LLC on March 31, 2014, and resolves to the IP address 107.180.115.116. The domain is secured with a Let's Encrypt SSL certificate, a tactic commonly employed by threat actors to mimic legitimate sites. It appears on one security blocklist and is flagged by 18 of 95 security vendors on VirusTotal, with Google Safe Browsing specifically identifying it under the SOCIAL_ENGINEERING category. The domain's long-standing registration date contrasts with its recent malicious activity, suggesting potential compromise or repurposing of an older, previously benign domain. Current status confirms hyperinteract.com remains active and unmitigated, continuing to resolve to its host IP. Organizations and end-users are advised to implement immediate blocking measures at the DNS and network levels, particularly targeting the IP 107.180.115.116. Security teams should monitor for connections to this domain in proxy logs and endpoint detection systems. Given the domain's use of a valid SSL certificate, users should be educated to scrutinize page content rather than relying solely on HTTPS indicators. Proactive measures include updating security policies to explicitly deny traffic to hyperinteract.com and conducting retrospective analysis to identify any prior interactions with this domain. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260627-6ECAC5 Favicon MD5: 0253cd4494db2b4d890ca1b3cd4c7012 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/hyperinteract.com/ JSON API: https://api.destroy.tools/v1/check?domain=hyperinteract.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 170,942 domains (13,576 alive under monitoring, 156,953 confirmed takedowns/dead). Site: https://phishdestroy.io