fwa[.]nnh[.]mybluehost[.]me

Analysis of the domain fwa.nnh.mybluehost.me shows a high‑risk, active phishing infrastructure. The domain was registered on 05 Oct 2016 through Domain.com – Network Solutions, LLC and continues to resolve to IP 50.6.34.190, which is allocated to AS31898 Oracle Corporation in Germany. DNS resolution uses the authoritative name servers ns1.mybluehost.me and ns2.mybluehost.me, both belonging to the hosting provider. The site presents an HTTP 302 redirect and serves a TLS certificate issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36 chain, confirming the presence of HTTPS. The only visible page title is "Welcome — Coming Soon," providing no functional content for assessment. Reputation metrics are extremely poor: Scamadviser assigns a trust score of 1 / 100, and the domain appears on two public blocklists—PhishDestroy and PhishingDB. VirusTotal scans report detections by 5 of 95 security vendors, reinforcing the malicious classification. While the exact phishing lure or credential‑harvesting page has not been observed, the combination of a low‑trust score, blocklist listings, and multiple vendor detections indicates a confirmed phishing threat. Defenders should block the domain at perimeter and DNS layers, monitor outbound connections to the associated IP address, and consider adding the IP to threat‑intel feeds. Ongoing surveillance is recommended to detect any changes in content or additional infrastructure components.