hoth[.]fr

The domain hoth.fr was registered on November 16, 2025 through Hosting Concepts B.V. d/b/a Registrar.eu and is currently active. It is classified as a generic phishing site and assigned a high risk level. The site returns HTTP 520, indicating an unknown server error, and the page title observed is "hoth.fr | 520: Web server is returning an unknown error". No visual or content analysis is available, so the exact phishing payload remains unknown.

Infrastructure analysis shows that hoth.fr resolves to the IP address 198.18.1.128, which is hosted by Cloudflare (AS13335) in the United States. The domain is served over TLS using a certificate issued by Google Trust Services under the WE1 profile, and it leverages Cloudflare's HTTP/3 support. Nameservers listed for the domain are lee.ns.cloudflare.com and reza.ns.cloudflare.com, confirming the reliance on Cloudflare's DNS and edge services.

Threat intelligence records indicate the domain appears on one security blocklist and has been flagged by the PhishDestroy repository. VirusTotal reports a single detection out of 95 scanned security vendors, suggesting limited but non‑trivial detection by anti‑malware engines. The combination of a recent registration date, Cloudflare fronting, and the presence on a blocklist reinforces the high‑risk assessment despite the low number of VirusTotal flags.

Defenders should prioritize adding hoth.fr to web filtering and DNS blocklists, monitor outbound connections to the associated IP, and consider sinkholing the domain via Cloudflare's DNS if feasible. Continuous re‑evaluation is advised, as the site may evolve to host credential‑stealing pages or additional malicious payloads once the underlying content becomes visible. Organizations should also watch for any changes in the domain's SSL certificate or name server configuration that could indicate a shift in control or threat actor tactics.