myfibonkbg[.]kimhir[.]eu

Analysis of the domain myfibonkbg.kimhir.eu, observed on July 23, 2026, indicates that the site was hosted on IP 185.80.129.90, an address assigned to AS61053 UAB ESNET in Lithuania. The domain resolves without an SSL certificate, and its authoritative name servers are dns1.regway.com, dns2.reg, dns3.regway.com, and dns4.regway.com. Registration was performed through PDR Ltd. d/b/a PublicDomainRegistry.com. The public page title returned by HTTP requests is “myfibonkbg.kimhir.eu — Coming Soon”, suggesting that the site was either under construction or deliberately presenting a placeholder page at the time of capture. VirusTotal records show that 16 of 95 scanning engines flagged the domain, and it appears on at least one external security blocklist.

PhishDestroy has also listed the domain as malicious. The current operational status is offline, which may be the result of takedown actions or the host removing the content. The available evidence confirms that the domain was used for a generic phishing campaign, although the specific lure or credential‑harvesting vector has not been captured. No HTTPS service was observed, limiting the ability to inspect potential malicious payloads.

The presence on multiple vendor blocklists and the detection ratio on VirusTotal provide strong confidence that the domain was abusive. Defenders should continue to block the domain at network perimeter devices, update DNS sinkhole entries, and monitor the associated IP address for any resurgence of activity. Because the registration details are publicly available, threat actors could potentially recreate a similar domain using the same registrar; therefore, organizations should consider implementing domain‑generation‑algorithm detection rules that flag newly observed subdomains under the kimhir.eu second‑level domain. Ongoing telemetry collection from passive DNS feeds is recommended to detect any re‑registration or reuse of the IP space.