h2[.]etop[.]ink

On July 23 2026 analysts observed that the domain h2.etop.ink is currently offline but retains several indicators of malicious infrastructure. The domain was registered through Sav.com LLC on 30 August 2025 and is hosted on the IPv4 address 178.16.53.103, which resolves to the Netherlands under ASN 202412 (Omegatech LTD). No TLS certificate is presented, confirming that the site was served over plain HTTP. The authoritative name servers are augustus.ns.cloudflare.com and laura.ns.cloudflare.com, both belonging to Cloudflare’s DNS service, a common choice for fast‑changing malicious sites.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a complete lack of reputation. The page title returned by the HTTP response is “Site is created successfully!”, which offers no functional description and may be used to obscure the underlying intent. VirusTotal recorded 15 detections out of 93 scanning engines, indicating that a minority of vendors have identified the domain as malicious. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy filtering service.

The risk rating assigned by internal scoring is elevated, consistent with the combination of low trust score, lack of encryption, and multi‑vendor detections. Because the site is offline, dynamic behavior cannot be verified, and the exact phishing payload or credential‑harvesting mechanism remains unknown. Defenders should continue to enforce blocklist rules for h2.etop.ink, monitor the hosting IP 178.16.53.103 for any re‑activation, and consider adding the domain to outbound URL filtering policies. Ongoing observation of the associated Cloudflare name servers is recommended, as they may be reused for future phishing infrastructure.