# PhishDestroy threat dossier — rewards-hyperlend.finance ================================================================ Fetched: 2026-07-26 18:25:03 UTC Canonical: https://phishdestroy.io/domain/rewards-hyperlend.finance/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/91 security vendors flagged this domain Flagging vendors: Forcepoint ThreatSeeker, Fortinet Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 62.60.226.88 (DE, Frankfurt am Main) ASN: ASAS214351 FEMOIT FEMO IT SOLUTIONS LIMITED, GB Hosting org: AS214351 FEMO IT SOLUTIONS LIMITED Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED !!! REGISTRAR INTEGRITY ALERT — NiceNIC !!! NiceNIC International: over 90% of its registered domains are associated with illegal content; documented systematic abuse-report non-response. Primary sources: https://phishdestroy.io/nicenic-real https://phishdestroy.io/nicenic-verdict Nameservers: coco.bunny.net, kiki.bunny.net Registered: 2026-07-24 Expires: 2027-07-24 Page title: HyperLend HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-10-22 Status: INVALID chain Fingerprint: f3a1d2301c33247b1b439517876988aa8e2f7f0d72b319fbb350aae7a43e78c3 Subject Alternative Names (related infrastructure — often same operator): - www.rewards-hyperlend.finance ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-24 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-25 07:40:33 UTC (by PhishDestroy tracker) Last verified: 2026-07-26 20:20:23 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f97c8-cc45-734b-959b-422c0b6cc8c8/ Wayback Machine: https://web.archive.org/web/*/rewards-hyperlend.finance crt.sh CT logs: https://crt.sh/?q=%25.rewards-hyperlend.finance Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=rewards-hyperlend.finance AlienVault OTX: https://otx.alienvault.com/indicator/domain/rewards-hyperlend.finance URLhaus: https://urlhaus.abuse.ch/host/rewards-hyperlend.finance/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-25 07:41:21 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] rewards-hyperlend.finance Phishing – High Risk Analysis of rewards-hyperlend.finance indicates that the domain was registered on July 24, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is presently active. DNS resolution points to the IPv4 address 62.60.226.88, and the authoritative name servers are coco.bunny.net and kiki.bunny.net, suggesting use of a third‑party hosting platform. VirusTotal scans show that two of ninety‑one security vendors have flagged the domain, providing limited but concrete evidence of malicious activity. The domain is listed on one external security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the suspicion of phishing use. While the presence of a blocklist entry and vendor detections substantiate the threat, several aspects remain unknown: the site’s TLS certificate status, HTTP response codes, page title, and any Safe Browsing or Open Threat Exchange (OTX) observations are not available in the current intelligence set. Defenders should treat the domain as high‑risk: ingest the domain and its resolving IP address into network and endpoint blocklists, monitor traffic for connections to 62.60.226.88, and enforce email filtering rules that quarantine any messages containing the domain or its sub‑domains. Continuous re‑evaluation is advised as additional telemetry (e.g., content analysis, additional vendor detections) becomes available. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 54f795fa273f199e773187d715ec02b8 TLS cert SHA-256: f3a1d2301c33247b1b439517876988aa8e2f7f0d72b319fbb350aae7a43e78c3 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/rewards-hyperlend.finance/ JSON API: https://api.destroy.tools/v1/check?domain=rewards-hyperlend.finance Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 199,053 domains (68,378 alive under monitoring, 129,126 confirmed takedowns/dead). Site: https://phishdestroy.io