hk399[.]net

On 23 July 2026 analysts observed the domain hk399.net being used in a generic phishing campaign. The domain was registered on 21 February 2026 through SGADDRESS PTE. LTD. and is hosted on the IP address 154.205.9.182, which belongs to AS132813 HK AISI CLOUD COMPUTING LIMITED in Hong Kong. The DNS configuration lists ns1.taoa.com and ns2.taoa.com as authoritative name servers. An SSL certificate identified as “E7” is present, indicating that transport encryption was enabled when the site was active.

The site was taken offline before the time of reporting, and current HTTP probes return no response, confirming its inactive status. Commercial threat‑intelligence feeds have already taken action against hk399.net. The domain is listed on a single security blocklist and was blocked by the PhishDestroy service. VirusTotal records show that 13 of 95 scanning engines flagged the domain as malicious, providing independent confirmation of its suspicious nature. AlienVault OTX includes hk399.net in 14 distinct threat‑intel pulses, suggesting that multiple researchers have encountered the same infrastructure.

No additional public page title or brand‑specific content has been published, so the exact phishing lure remains unknown. Given the available evidence, defenders should continue to block hk399.net at perimeter defenses and update any URL filtering or DNS sinkhole policies. Monitoring of the hosting provider’s ASN (AS132813) for new domains that resolve to the same IP range is advisable, as threat actors often recycle infrastructure. Analysts should also watch for future registrations that reuse the same registrar or nameserver pair, which may indicate a repeat of the same campaign. Because the site is currently offline, active exploitation is unlikely, but the historical activity demonstrates a pattern that warrants inclusion in broader phishing threat‑intel feeds.