h5.scgame01.com: Confirmed Phishing Site

The domain h5.scgame01.com was registered on July 17, 2026 through Dominet (HK) Limited. It resolves to the IPv4 address 18.64.211.50 and is served by the nameservers devin.ns.cloudflare.com, ns-1205.awsdns-22.org, ns-1624.awsdns-11.co.uk, and ns-408.aws. The domain is currently active. Multiple threat‑intelligence sources have flagged the host as a phishing infrastructure. PhishDestroy lists the domain as blocked, and it appears on one external security blocklist.

VirusTotal has processed the domain with 91 scanning engines; none of the engines raised a detection at the time of analysis, but the absence of detections does not prove the domain to be safe. No public page title, HTTP response code, SSL certificate details, or content capture have been published, leaving the exact phishing lure unknown. Consequently, the specific brand or campaign targeted cannot be identified, and the classification remains generic phishing based on the observed infrastructure. Defenders should treat the domain as hostile. Immediate mitigation steps include adding both the domain and its resolving IP address (18.64.211.50) to DNS and web‑proxy blocklists, updating endpoint‑protection signatures, and monitoring for outbound connections to the IP.

Because the domain uses Cloudflare and AWS DNS services, the hosting environment may be shared with legitimate sites, so any correlation with other suspicious activity should be performed before taking downstream services offline. Analysts should continue to collect passive DNS records, TLS handshake data, and future page snapshots to refine the threat profile. Regular re‑scanning with multi‑engine services such as VirusTotal is recommended to detect any emergence of malicious payloads. Until additional evidence is obtained, the domain should remain classified as an active phishing infrastructure under investigation.