habilitar-email365[.]hstn[.]me

Analysis as of July 20, 2026 identifies habilitar-email365.hstn.me as an active malicious infrastructure used for generic phishing. The domain was registered on June 03, 2019 through Porkbun LLC and continues to resolve to the IPv4 address 185.27.134.125. The hosting IP is currently listed on a single security blocklist, PhishDestroy, indicating that at least one network security product has flagged the domain for malicious activity. VirusTotal scans show that three of ninety‑one independent security vendors have flagged the domain, reinforcing the suspicion of abuse. The domain’s nameserver configuration is not publicly observable (NS_NOT_FOUND), which can hinder rapid takedown but does not affect its operational capability. No additional intelligence such as SSL certificate details, HTTP response codes, or page title is available at this time, leaving the exact content and targeting of the phishing campaign unverified. Defenders should consider adding habilitar-email365.hstn.me to blocklists at perimeter and endpoint solutions, monitor traffic to the associated IP address 185.27.134.125, and investigate any authentication attempts that reference Microsoft Office 365 services, as the subdomain suggests a possible focus on compromising email accounts. Ongoing observation of the IP’s hosting provider and any future detection updates will be necessary to assess whether the infrastructure expands or changes. The limited detection footprint underscores the importance of proactive containment despite the relatively low number of vendor flags.