hk[.]nano-dev[.]shop

Analysis of hk.nano-dev.shop shows a credential‑phishing infrastructure that was taken offline prior to the report date of July 25 2026. The domain was registered on August 15 2025 through Cosmotown Inc. and uses the authoritative nameservers ns1.coreserverhost.com and ns2.coreserverhost.com. DNS resolution points to the IPv4 address 198.12.80.250, which belongs to AS36352 operated by HostPapa and is geolocated in the United States. No TLS certificate was observed for the host, indicating that the site was served over plain HTTP.

The sole page retrieved during the brief scan returned the title "Login," consistent with a credential‑collection landing page. VirusTotal scans recorded three positive detections out of ninety‑five antivirus engines, confirming that at least a subset of security products identify the domain as malicious. The domain appears on a single public blocklist and is specifically listed as blocked by PhishDestroy. The risk rating is elevated, and the current status is offline, suggesting that the operators have either ceased activity or are rotating infrastructure.

Defenders should continue to monitor the IP address 198.12.80.250 for any re‑use, enforce blocklists that include hk.nano-dev.shop, and consider adding the domain to internal deny lists. Because the site lacks SSL, any future re‑appearance would be trivially detectable via HTTP‑only checks. Further investigation is limited by the absence of additional artifacts such as malware samples, URL patterns, or victim reports; therefore, threat actors’ broader campaign scope remains uncertain.