# PhishDestroy threat dossier — noticiasnews.online ================================================================ Fetched: 2026-07-29 15:29:28 UTC Canonical: https://phishdestroy.io/domain/noticiasnews.online/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 88/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 45.89.204.205 (US, Asheville) ASN: AS47583 Hostinger International Limited Hosting org: Hostinger International Limited Registrar: HOSTINGER operations, UAB Nameservers: ["ns1.dns-parking.com", "ns2.dns-parking.com"] Page title: noticiasnews.online HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YE1 Expires: 2026-10-22 Status: INVALID chain Fingerprint: ffeb1e2d943e3dab7e31e615b6acf74822095cfd6cf9065138f67d40c624bd78 Subject Alternative Names (related infrastructure — often same operator): - www.noticiasnews.online ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-27 16:13:09 UTC (by PhishDestroy tracker) Last verified: 2026-07-29 16:20:24 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-27 16:15:25 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] noticiasnews.online Safety Check — Generic Phishing Detected On 27 July 2026 the domain noticiasnews.online was observed serving HTTP responses with status code 200. The domain is currently registered through HOSTINGER operations, UAB and uses the default parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. No SSL certificate information is available in the collected data, and the page title has not been captured, so the visual content of the site remains unknown. VirusTotal records indicate that the domain has been scanned by 91 antivirus and URL‑reputation vendors; none of those vendors raised a detection at the time of scanning. The lack of a detection does not constitute proof of legitimacy, especially given that the domain is listed on at least one external phishing blocklist and has been actively blocked by the PhishDestroy filtering service. The blocklist entry confirms that the infrastructure is being used for generic phishing, consistent with the threat type assigned in the intelligence feed. The registration details, parking nameservers, and the fact that the site returns a successful HTTP 200 response suggest a low‑cost hosting setup often employed by opportunistic attackers. Because the site is served from a parking provider, it may be leveraged as a redirect hub or as a temporary landing page for credential harvesting campaigns. No evidence of TLS, HSTS, or known phishing kits was observed, so the exact method of credential capture cannot be confirmed. No additional indicators such as IP address, ASN, or geographic location were provided, leaving the hosting environment largely uncharacterised. The presence on a single blocklist indicates that the domain has already been reported by at least one victim or security researcher, but the limited visibility across other blocklists suggests that the campaign may be in an early stage or targeting a narrow audience. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: ffeb1e2d943e3dab7e31e615b6acf74822095cfd6cf9065138f67d40c624bd78 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/noticiasnews.online/ JSON API: https://api.destroy.tools/v1/check?domain=noticiasnews.online Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,484 domains (83,251 alive under monitoring, 109,716 confirmed takedowns/dead). Site: https://phishdestroy.io