# PhishDestroy threat dossier — pools-onyx.com ================================================================ Fetched: 2026-06-26 13:10:12 UTC Canonical: https://phishdestroy.io/domain/pools-onyx.com/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: status_split) (score: 3/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/91 security vendors flagged this domain Flagging vendors: Gridinsoft URLQuery: 2 detections AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 88.223.85.104 (US, Boston) Hosting org: AS47583 Hostinger International Limited Registrar: HOSTINGER operations, UAB Nameservers: artemis.dns-parking.com, hermes.dns-parking.com Registered: 2026-05-31 Expires: 2027-05-31 Page title: Default page ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-08-29 Status: INVALID chain Fingerprint: 450c93a07462df8e0861a7ce76ffa9185855d5f26fc0f2be197cd6c84ed6f184 Subject Alternative Names (related infrastructure — often same operator): - www.pools-onyx.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-31 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-15 13:33:56 UTC (by PhishDestroy tracker) First reported: 2026-06-17 17:05:29 UTC (abuse notice filed) Last verified: 2026-06-26 12:20:35 UTC Neutralised: 2026-06-16 00:40:13 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019ecb0e-0779-778c-9ff7-731e9f488765/ URLQuery: https://urlquery.net/report/8b32366d-9f41-4404-ba63-133058e582e2 Wayback Machine: https://web.archive.org/web/*/pools-onyx.com crt.sh CT logs: https://crt.sh/?q=%25.pools-onyx.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=pools-onyx.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/pools-onyx.com URLhaus: https://urlhaus.abuse.ch/host/pools-onyx.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-25 18:25:01 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, pools-onyx.com, is flagged as a high-risk credential harvesting phishing infrastructure. Analysis indicates it is actively targeting users through deceptive web pages designed to capture login credentials, authentication tokens, or sensitive financial information. The site presents a generic 'Default page' title, suggesting either placeholder content or an attempt to evade detection by security tools scanning for known phishing templates. Infrastructure analysis reveals the domain was registered on May 31, 2026, through HOSTINGER operations, UAB, a registrar frequently associated with newly established phishing sites. It resolves to IP address 88.223.85.104, hosted on AS47583 (Hostinger International Limited) in the United States. The domain is currently listed on three security blocklists and is flagged by 1 out of 95 security vendors on VirusTotal, indicating low but growing detection coverage. The SSL certificate is issued by Let's Encrypt (YR1), a common choice for threat actors due to its free and automated issuance process. Despite minimal vendor detections, the domain's recent creation date, generic page structure, and presence on multiple blocklists signal active malicious intent. Mitigation against credential harvesting phishing requires multi-layered defenses. Network-level protections should include blocking the domain (pools-onyx.com) and its resolving IP (88.223.85.104) at firewalls and DNS filters. Endpoint security tools should be configured to detect and prevent access to newly registered domains, particularly those using Let's Encrypt certificates with short validity periods. User awareness training should emphasize the risks of 'Default page' or blank landing pages, which may precede redirection to credential capture forms. Organizations should enforce multi-factor authentication (MFA) to reduce the impact of stolen credentials, and monitor for unusual authentication attempts originating from the identified infrastructure. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260617-A76587 Favicon MD5: ff3a0706aa6dc4bfaca6f894fa5bdedf TLS cert SHA-256: 450c93a07462df8e0861a7ce76ffa9185855d5f26fc0f2be197cd6c84ed6f184 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/pools-onyx.com/ JSON API: https://api.destroy.tools/v1/check?domain=pools-onyx.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 170,343 domains (12,390 alive under monitoring, 157,587 confirmed takedowns/dead). Site: https://phishdestroy.io