hngk120[.]net

Analysis of hngk120.net shows the domain was registered on 21 February 2026 through Deep Water Domains LLC and is hosted on Cloudflare’s network (ASN 13335) with the IP address 188.114.97.3 located in the United States. The domain resolves to Cloudflare’s edge service and presents a valid SSL certificate issued by Google Trust Services under the WE1 certificate authority, indicating proper TLS termination. HTTP probing returns a 200 OK status, but the page title returned by the server is “404 Not Found”, suggesting the site is either serving a placeholder error page or intentionally obscuring its content.

The infrastructure uses Cloudflare’s HTTP/3 protocol, consistent with the observed technologies. Reputation checks reveal that two of ninety‑three VirusTotal scanners have flagged the domain, and the domain appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL, all of which have it listed as active. No additional intelligence such as a targeted brand, specific phishing kit, or payload has been published, so the exact malicious intent remains unclear beyond the generic phishing classification.

Defenders should block network connections to 188.114.97.3 and add hngk120.net to URL filtering rules. Monitoring for future DNS or certificate changes is advised, as the presence of a legitimate TLS certificate can facilitate credential‑stealing pages. Organizations using cloud‑based email or web gateways should ensure that the domain is included in their threat intelligence feeds, and incident response teams should treat any communications originating from or referencing this domain as potentially malicious.