hbull[.]earn-token[.]fun

The domain hbull.earn-token.fun is under active investigation for involvement in generic phishing activity as of July 30, 2026. Domain registration records confirm it was created on July 29, 2026, using the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain is configured with Cloudflare nameservers (donald.ns.cloudflare.com and paris.ns.cloudflare.com) and currently resolves to the IP address 188.114.97.3. This infrastructure is associated with content delivery and potential masking of the domain’s true hosting origin, which can be indicative of attempts to evade detection or attribution.

At this time, hbull.earn-token.fun appears on one security blocklist, specifically flagged by PhishDestroy, which provides direct evidence of reputation concerns in the security community. VirusTotal reports that 91 vendors have scanned the domain, but none currently detect it as malicious. This absence of detections does not guarantee the domain's safety or legitimacy, especially given its recent creation and blocklist presence. The live status of the domain further increases risk, as attackers often exploit new registrations for phishing before automated detection mechanisms are fully updated.

There is no data available regarding the site’s content, page title, SSL configuration, or specific brands or credentials targeted. No classification beyond 'generic phishing' is provided, and defenders should not assume the domain is benign based on low detection rates alone. Security teams are advised to monitor network and email traffic for interactions with hbull.earn-token.fun, update blocklists where appropriate, and await further intelligence for a more definitive risk assessment. Continued vigilance is warranted until the domain’s intent and content can be directly analyzed.