bh[.]tcloudbaseapp[.]com[.]ouowoh[.]cn

The domain bh.tcloudbaseapp.com.ouowoh.cn was registered on February 21 2026 through 阿里云计算有限公司（万网） and is actively serving HTTP content (status 200) without an SSL certificate. The site presents a page titled 天气小工具, which translates to "Weather Widget," indicating a brand‑impersonation attempt aimed at weather‑related services. DNS resolution points to IP 35.220.253.102, located in Hong Kong and owned by AS396982 Google LLC. Nameservers dns9.hichina.com and dns10.hichina.com are associated with the registrar. Threat intelligence shows the domain is flagged by 9 of 93 VirusTotal scanners and receives a Gridinsoft trust score of 0 / 100. It is listed on one security blocklist and has been blocked by PhishDestroy. The infrastructure remains active as of the report date. While the exact malicious payload or credential‑collection mechanisms have not been publicly disclosed, the combination of a deceptive page title, lack of TLS, and multiple security detections suggests a high‑risk phishing operation. Defensive teams should immediately add bh.tcloudbaseapp.com.ouowoh.cn to URL and DNS blocklists, monitor traffic to the associated IP address, and consider sinkholing or null‑routing the host. Ongoing observation of the domain’s hosting environment and any changes to its content or TLS status is recommended to detect potential escalation.