shatin-hk[.]com

This domain, shatin-hk.com, was registered on February 19, 2026 through ENOM, INC. and is hosted on the Host Sailor Ltd infrastructure (AS60117). The authoritative nameservers are ns5.nl.hostsailor.com and ns6.nl.hostsailor.com, and the domain resolves to the IPv4 address 194.36.191.196 located in the Netherlands. An HTTPS service is provided by a Let’s Encrypt R12 certificate, and the web server returns HTTP 200 for the landing page.

The landing page advertises a “Sha Tin Group — Global Lending & Institutional Funding Solutions” title, a classic lure used in generic phishing campaigns that impersonate financial services. The site presents a professional‑looking layout but lacks any legitimate corporate identifiers, matching the pattern of credential‑harvesting portals. The combination of a recent registration date, a low Gridinsoft trust score of 0 out of 100, and the use of a free TLS certificate further supports the malicious intent.

Threat intelligence sources have classified the domain as a generic phishing site and have assigned a high risk rating. The domain appears on two public blocklists, including PhishDestroy and BLP‑Malware, and two security vendors on VirusTotal flagged the site out of ninety‑five scans. These detections corroborate the phishing classification despite the limited number of vendor hits.

Defenders should block network communications to 194.36.191.196 and add shatin-hk.com to URL filtering policies. Incident response teams should monitor for credential submissions that reference “Sha Tin Group” or related financial terminology, and consider sink‑holing the domain to capture additional payloads. Continuous monitoring of the host’s ASN and associated IP ranges is advised, as the infrastructure may be reused for further campaigns.