nvidia-gpu[.]hl[.]cn

Analysis indicates that the domain nvidia-gpu.hl.cn is currently active and has been identified as a generic phishing infrastructure. The domain was registered on June 24, 2026 through the registrar 中企动力科技股份有限公司 and is hosted on nameservers ns1.363.hk and ns2.363.hk. DNS resolution points to the IPv4 address 166.75.89.12, which is the sole hosting endpoint associated with the observed activity. The domain is listed on one public security blocklist and has been flagged by the PhishDestroy takedown service, confirming that it is recognized by at least one anti‑phishing consortium.

VirusTotal scans show that five of ninety‑one security vendors have reported the domain as malicious, providing additional corroboration of its abusive nature. No public page title, SSL certificate details, or HTTP response codes have been disclosed, leaving the exact content and credential‑collection mechanisms unverified at this time. Consequently, the observable evidence consists of registration metadata, DNS infrastructure, blocklist inclusion, and partial vendor detections. Defenders should immediately add nvidia-gpu.hl.cn and its resolving IP address 166.75.89.12 to network‑level deny lists and URL filtering policies.

Continuous monitoring of the associated nameservers (ns1.363.hk, ns2.363.hk) is advised, as they may host additional malicious domains. Organizations should also watch for any future VirusTotal or threat‑intel updates that could reveal further indicators such as TLS fingerprints or malicious payloads. Given the domain’s recent creation date and active status, proactive blocking is recommended to mitigate potential credential‑theft campaigns before additional evidence emerges.