# PhishDestroy domain threat record: ppp046177238004.access.hol.gr Content language: English Canonical HTML report: https://phishdestroy.io/domain/ppp046177238004.access.hol.gr/ Machine-readable companion: https://phishdestroy.io/domain/ppp046177238004.access.hol.gr/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-05 16:40:10 UTC - Last availability or vendor check: 2026-10-22 10:49:39 UTC - Stored record updated: 2026-10-22 19:02:40 UTC - VirusTotal detections in the stored snapshot: 1/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 46.177.238.4 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/ppp046177238004.access.hol.gr - Certificate Transparency search: https://crt.sh/?q=%25.ppp046177238004.access.hol.gr - Web Archive lookup: https://web.archive.org/web/*/https://ppp046177238004.access.hol.gr/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview ppp046177238004.access.hol.gr is a suspicious host on the PhishDestroy blocklist, first seen by PhishDestroy on 2026-08-05. It does not imitate a known crypto brand. Its name encodes the address 46.177.238.4 under a Greek access-network domain, the naming pattern ISPs use for subscriber connections, so it is not a branded website. As of 2026-10-19 the host still responds, but no page content could be loaded from it. How the scam works No page title, brand or phishing kit has been tied to this host, so a specific scheme cannot be named. The risk comes from a crypto-fraud blocklisting attached to a raw connection address rather than a normal site. Hosts like this can serve short-lived pages, redirect visitors elsewhere, or act as a back end for a scam that is promoted under another name. Anyone sent here by a link should treat any wallet prompt, login form or download as hostile. Evidence Backing for the listing is thin and should be weighed that way. On 2026-09-15, one of 89 VirusTotal engines flagged the host, and that engine was CRDF, a vendor that tracks phishing and fraud infrastructure. Outside PhishDestroy's own listing, no other blocklist carries it. This is a lone signal, not a broad consensus, which fits a host that changes what it serves or that few scanners have reached. Infrastructure The address sits on the Vodafone-panafon Hellenic Telecommunications Company SA network in Greece. The hostname belongs to the provider's address space, so there is no separate domain registration and no registrar behind it. A scam component on consumer or business connectivity like this is easy to move. Because the content is unreachable while the connection stays live, whatever ran here may be offline or available only to selected visitors. What to do If you opened a link to this host, close it and do not return. If you typed a password, seed phrase or private key on any page reached through it, treat that secret as compromised. Move funds to a new wallet and change passwords, turning on app-based two-factor authentication. If you downloaded anything, scan the device before using it for crypto again. Defenders should block the hostname and 46.177.238.4 at DNS and proxy level and search logs from 2026-08-05 onward for connections to either. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/ppp046177238004.access.hol.gr Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ppp046177238004.access.hol.gr Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:50:42 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b76ca596-fc15-4968-bb58-158dd81bc698.png Captured: 2026-09-13 15:41:53 UTC Source report: https://radar.cloudflare.com/scan/b76ca596-fc15-4968-bb58-158dd81bc698 SHA-256: fdc4a7b0bfa465af56a4edaa88bec2b53dacb3a04c4b8a15c8146c8df95c5081 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-21T00:27:14Z", "uuid": "b76ca596-fc15-4968-bb58-158dd81bc698", "scanned_at": "2026-09-13T15:41:53Z", "final_url": "https://ppp046177238004.access.hol.gr/", "history": [ { "url": "https://ppp046177238004.access.hol.gr/", "status": 0 } ], "dom_hash": "222edc6576ce4f900a55dd02c5523f77c5fa64ee8b4e540f3ff8452026c169a8", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "ppp046177238004.access.hol.gr", "type": "A", "value": "46.177.238.4" } ], "dnssec_valid": false }, "vt": { "v": 1, "fetched_at": "2026-10-22T13:26:39Z", "analysis_at": "2026-09-15T02:00:07Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 1, "suspicious": 0, "undetected": 38 }, "detections": { "CRDF": "malicious" }, "reputation": 0, "tags": [ "hex", "dga" ], "categories": { "BitDefender": "business", "Forcepoint ThreatSeeker": "information technology" }, "first_seen": "2026-06-24T12:38:53Z", "dns": [ { "ttl": 21600, "type": "A", "value": "46.177.238.4" } ], "dns_at": "2026-09-15T02:00:48Z" } } ```