h5[.]inve-romimqgc[.]com

Analysis of h5.inve-romimqgc.com as of 23 July 2026 indicates the domain was registered on 15 July 2026 through Dominet (HK) Limited. The domain resolves to the IPv4 address 52.222.136.61 and is served by four authoritative nameservers: devin.ns.cloudflare.com, ns-1448.awsdns-53.org, ns-1837.awsdns-37.co.uk, and ns-269.aws. VirusTotal records show the domain has been scanned by 91 security vendors, none of which reported a detection at the time of analysis.

The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service, suggesting that threat‑intelligence feeds have flagged it as malicious. The classification in the supplied data is “generic phishing,” and the risk level is listed as “under investigation” while the operational status remains “active.” No additional public indicators such as SSL certificate details, HTTP response codes, page titles, or reputation scores are available in the current dataset. Consequently, the absence of further evidence leaves the exact phishing payload or targeted brand undefined.

Defenders should treat the domain as potentially hostile: block network traffic to the IP address, add the domain to internal blocklists, and monitor DNS queries for look‑ups. Continuous re‑evaluation is advised, especially if future VirusTotal scans yield detections or additional blocklist entries emerge. Until more contextual data (e.g., page content or observed credential harvesting) is collected, the safest posture is to assume the domain is being used for credential‑stealing or other malicious activity.