ppp046177238004.access.hol.gr is a suspicious host on the PhishDestroy blocklist, first seen by PhishDestroy on 2026-08-05. It does not imitate a known crypto brand. Its name encodes the address 46.177.238.4 under a Greek access-network domain, the naming pattern ISPs use for subscriber connections, so it is not a branded website. As of 2026-10-19 the host still responds, but no page content could be loaded from it.
How the scam works
No page title, brand or phishing kit has been tied to this host, so a specific scheme cannot be named. The risk comes from a crypto-fraud blocklisting attached to a raw connection address rather than a normal site. Hosts like this can serve short-lived pages, redirect visitors elsewhere, or act as a back end for a scam that is promoted under another name. Anyone sent here by a link should treat any wallet prompt, login form or download as hostile.
Evidence
Backing for the listing is thin and should be weighed that way. On 2026-09-15, one of 89 VirusTotal engines flagged the host, and that engine was CRDF, a vendor that tracks phishing and fraud infrastructure. Outside PhishDestroy's own listing, no other blocklist carries it. This is a lone signal, not a broad consensus, which fits a host that changes what it serves or that few scanners have reached.
Infrastructure
The address sits on the Vodafone-panafon Hellenic Telecommunications Company SA network in Greece. The hostname belongs to the provider's address space, so there is no separate domain registration and no registrar behind it. A scam component on consumer or business connectivity like this is easy to move. Because the content is unreachable while the connection stays live, whatever ran here may be offline or available only to selected visitors.
What to do
If you opened a link to this host, close it and do not return. If you typed a password, seed phrase or private key on any page reached through it, treat that secret as compromised. Move funds to a new wallet and change passwords, turning on app-based two-factor authentication. If you downloaded anything, scan the device before using it for crypto again. Defenders should block the hostname and 46.177.238.4 at DNS and proxy level and search logs from 2026-08-05 onward for connections to either.
