web-domain[.]fwh[.]is

The domain web-domain.fwh.is was registered on 2024-11-01 through FreeWebHostingArea and is delegated to the Byet.org name server cluster (ns1.byet.org, ns2.byet.org, ns3.byet.org, ns4.byet.org). DNS resolution points to IP address 77.72.1.44, which is allocated to Krystal Hosting Ltd in the United Kingdom (AS12488). No TLS certificate is presented, meaning any HTTP traffic to the host is unencrypted. The site currently returns a page titled "ドメイン停止中", indicating the domain has been taken offline.

Despite the offline status, the domain appears on a public security blocklist and has been actively blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing source has flagged it. VirusTotal analysis records 16 of 93 scanning engines marking the host as malicious, providing additional vendor‑level corroboration of abusive activity. No archived page content, target brand, or specific phishing payload has been captured, so the exact technique and victim profile remain uncertain.

Security teams should continue to block the domain at DNS and network perimeter layers, monitor for any future resolution to the same IP range, and consider adding the IP address to threat‑intel watchlists. Because the hosting provider uses shared infrastructure, other domains on the same name servers may be leveraged for future campaigns; periodic re‑scanning of the IP and associated hostnames is advised. Incident response personnel should treat any traffic from this host as potentially malicious, isolate affected endpoints, and collect relevant logs for further analysis.