hilofet[.]com

hilofet.com entered the PhishDestroy evidence set on Jun 22, 2026. The assembled evidence scores 100/100 (critical).

Three independent sources are positive: VirusTotal, Spamhaus DBL, and Cloudflare Radar. VirusTotal recorded 20 detections among 91 engines: ADMINUSLabs, alphaMountain.ai, AlphaSOC, ArcSight Threat Intelligence, BitDefender, Certego, Chong Lua Dao, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Seclookup, SOCRadar, Sophos, Viettel Threat Intelligence, VIPRE on Jul 19, 2026 at 23:49 UTC. Spamhaus DBL: DBL_BOTNET on Jul 19, 2026 at 14:35 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the malware category; its verdict timestamp was not retained. The evidence is not unanimous. AlienVault OTX listed 11 community pulse references (not vendor detections) on Jul 19, 2026 at 23:52 UTC. The external blocklist snapshot contained no matches on Aug 7, 2026 at 14:20 UTC. Google Safe Browsing returned no flag on Jul 19, 2026 at 23:50 UTC.

HTTP 200 was recorded on Aug 7, 2026 at 10:14 UTC. Registration records for the domain list CNOBIN INFORMATION TECHNOLOGY LIMITED as the registrar. At collection time, the hostname resolved to 172.67.166.184 on AS13335 (Cloudflare, Inc.). The recorded endpoint location is Toronto, CA. The stored server header is cloudflare. Captured page title: “hilofet.com | 521: Web server is down”. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Oct 9, 2026; checked Jul 19, 2026 at 11:03 UTC.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. Taken together, the page content and independent findings support classifying this hostname as phishing. The stored record does not establish the post-click interaction, and it does not claim a confirmed wallet-draining transaction or credential submission.