hnbote[.]com

PhishDestroy identifies hnbote.com as a confirmed phishing site hosting a fake ‘Order Confirmation’ scam aimed at harvesting payment card and personal data under the guise of a bogus purchase receipt. The domain is weaponized to deceive users who click links in spam emails or malicious ads. The campaign exploits urgency by claiming a recent ‘order’ requires immediate action to cancel or update payment details, mirroring tactics documented in Q2-2024 campaigns targeting e-commerce users.

This domain was flagged with high confidence after cross-referencing multiple threat feeds. VirusTotal shows 4 out of 95 engines currently detect the threat (undetected as of seed 7bda0e), indicating a fast-moving campaign flying under legacy detection. It resolves to IP 188.114.96.3, a known bulletproof hosting provider linked to prior credential harvesting campaigns. The domain was created on March 9, 2017, suggesting long-term ownership likely repurposed for malicious use after years of dormancy. SSL certificate issued by Google Trust Services (GTS) provides a veneer of legitimacy, increasing trust hijacking potential. No listings on major public blocklists were found at time of analysis, leaving users unprotected by default browser or DNS defenses.

To mitigate risk, users should immediately block hnbote.com at DNS and firewall levels. Organizations are advised to implement browser isolation for high-risk domains and deploy AI-driven content disarm and reconstruction (CDR) on email gateways to neutralize embedded phishing artifacts. The absence of AV detections underscores the need for behavioral anomaly detection and proactive threat hunting focused on unusual SSL issuance patterns and dormant domain reactivation events. Report any interaction with this domain via official security portals and notify payment card providers if credentials were entered. Continuous monitoring of this seed pattern is required due to ongoing infrastructure changes.