fih[.]rest

The domain fih.rest was registered on 22 March 2026 through Global Domain Group Inc. It is hosted on the Cloudflare network and resolves to the IPv4 address 172.67.187.82, which is geolocated to Canada. The authoritative name servers are khalid.ns.cloudflare.com and lana.ns.cloudflare.com. HTTP requests return status code 200 and the site presents a TLS certificate issued by Let’s Encrypt (subject E8). Content analysis shows the page title “$FIH Is Calling | on BONK”, indicating a fake airdrop lure targeting users of the BONK token. Automated scans on VirusTotal recorded 3 detections out of 94 vendors, and the domain is listed on three public blocklists, with additional blocking by PhishDestroy, MetaMask, and SEAL. The site runs a Node.js stack with Vue.js and Nuxt.js, and Cloudflare Browser Insights indicates HTTP/3 support. Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. Current status is active; no further evidence of the payload or credential‑harvesting pages has been captured. Uncertainty remains regarding the exact phishing form and whether additional infrastructure is used. Defenders should add fih.rest to DNS‑based deny lists, enforce web‑proxy filtering, monitor for outbound connections to 172.67.187.82, and consider sinkholing the domain. Continuous re‑evaluation is advised as threat actors may modify the site or deploy new content.