hahahle1998[.]fnos[.]net

The domain hahahle1998.fnos.net was observed with a page title identical to the host name. Registration records show the domain was created on 26 April 2024 through Alibaba Cloud Computing Ltd. d/b/a HiChina, and it is served by the authoritative nameservers n1.fnnas.com and n2.fnnas.com. DNS resolution points to the IPv4 address 125.77.176.242, which belongs to AS133776 in Quanzhou, China. No TLS certificate is presented for the host, indicating that connections are unencrypted. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service; the single blocklist listing indicates early detection, but the low visibility may reflect limited propagation.

A trust‑score assessment from Gridinsoft assigns a value of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal reports that the host was scanned by 95 anti‑malware vendors; at the time of analysis none of the engines flagged the domain, though this lack of detections should not be interpreted as a validation of safety. The site is currently offline, and its status is recorded as “taken offline.” Because the HTTP service is no longer reachable, direct content inspection was not possible, leaving the exact phishing vector and targeted brand undefined. The combination of a freshly registered domain, low‑reputation registrar, Chinese hosting, absence of encryption, and a zero trust score aligns with patterns commonly observed in generic phishing campaigns.

Alibaba Cloud Computing Ltd. d/b/a HiChina is a known registrar for many malicious domains, which raises additional suspicion. Security teams are advised to incorporate the IP address and the domain into DNS‑based denial lists, to enforce TLS inspection policies that would capture any future re‑activation, and to monitor for re‑registration of the same name or for additional domains resolving to the same IP block.