liho[.]fi

liho.fi was registered on 2024-04-02 through Plus Verkot Oy and resolves to 164.215.36.215, an address allocated to AS49282 Verne Vantaa Oy in Finland. The server presents an Apache HTTP Server banner and serves a default directory listing with the title “Index of /”. An SSL certificate issued by Let’s Encrypt (R12) is active, confirming that HTTPS connections are accepted. The domain’s MX record points to liho-fi.mail.protection.outlook.com, indicating use of Microsoft’s email filtering service.

VirusTotal scans show that four of ninety‑three security vendors have flagged the domain, suggesting malicious activity despite a low overall detection rate. The domain appears on a single public blocklist and is listed by PhishDestroy, which has taken the site offline as of the reporting date. The trust score assigned by Gridinsoft is 0 out of 100, reinforcing the assessment of poor reputation. No additional intelligence such as Safe Browsing, OTX, or detailed payload analysis is available, and the page content beyond the directory index has not been captured.

Based on the available infrastructure indicators—recent registration, Finnish hosting, use of a generic Apache server, low‑trust SSL, and multiple vendor detections—the domain should be treated as a high‑confidence phishing infrastructure. Defenders are advised to block the domain at network perimeters, add the IP address 164.215.36.215 to deny‑list rules, and monitor for any future re‑registration or related sub‑domains. Email security gateways should reject messages originating from or referencing liho.fi, and incident response teams should verify whether any credential‑theft campaigns have leveraged this domain. Ongoing observation of the associated ASN and any new detections by security vendors will help maintain situational awareness.