hobgroup[.]us

Analysis of hobgroup.us indicates an active phishing domain targeting user credentials, currently under formal investigation. The domain was registered on August 26, 2025, through Dynadot Inc, a registrar frequently observed in phishing infrastructure. It resolves to the IP address 192.227.159.251, which has been associated with other suspicious domains in recent months. Nameserver records point to plr1.infracloudh.in and plr2.infracloudh.in, a hosting pattern consistent with known phishing campaigns leveraging cloud-based infrastructure for rapid deployment and evasion. As of July 27, 2026, the domain appears on one security blocklist, specifically PhishDestroy, which flags it as malicious.

No detections were recorded by the 91 vendors that scanned the domain on VirusTotal, though the absence of detections does not confirm benign status. The domain remains active, with no public reports of takedown requests or sinkholing. The exact nature of the phishing content—such as the targeted brand or service—has not been confirmed through available metadata, as no page title, brand target, or scam kit details were provided in the intelligence feed. Defenders are advised to treat hobgroup.us as a high-risk domain pending further analysis.

Network-level blocking is recommended for organizations, particularly those in sectors frequently targeted by credential harvesting campaigns. Security teams should monitor related infrastructure, including the IP 192.227.159.251 and the nameservers plr1.infracloudh.in and plr2.infracloudh.in, for additional malicious domains. If user reports or automated crawls reveal the phishing page’s content, further classification—such as the impersonated brand or scam type—should be documented to refine detection rules. Given the domain’s recent registration and active status, continued vigilance is warranted.