v1[.]hoanganh[.]blog

PhishDestroy identifies v1.hoanganh.blog as a live credential-harvesting endpoint actively impersonating a legitimate service to steal user login credentials. This domain resolves to IP 194.233.72.37, registered on April 25, 2026 through Spaceship, Inc., and secured with a Let’s Encrypt SSL certificate to appear legitimate. The absence of detections (0/95 on VirusTotal) indicates a stealthy, recently deployed campaign that has not yet been widely recognized by security engines. This domain poses an immediate risk as it is designed to mimic a trusted service and capture submitted credentials via a spoofed login interface. The low detection count (0/95) combined with a recent registration date (April 25, 2026) and hosting on a bulletproof-friendly IP range suggests an opportunistic, short-lived operation aimed at harvesting account credentials before blacklists catch up. Given the generic nature of the domain and the use of a legitimate registrar and SSL provider, users are unlikely to detect the deception without prior threat intelligence. If you visited v1.hoanganh.blog or entered any credentials, immediately change the passwords used on that site and enable multi-factor authentication on all related accounts. Report the domain to your security team and monitor accounts for signs of compromise. Do not interact with this domain further, and block the IP 194.233.72.37 at the network perimeter to prevent additional access. This campaign is under active investigation by PhishDestroy, and updated IOCs will be published as new evidence emerges.