f7r2va[.]cn

Analysis of f7r2va.cn indicates that the domain was registered on 21 February 2026 and is presently taken offline. The domain resolves to IP 156.226.74.145, an address located in Hong Kong and assigned to AS135097 LUOGELANG (FRANCE) LIMITED. The hosting infrastructure has been flagged by at least one security blocklist and by the PhishDestroy feed, confirming its association with phishing activity. The SSL certificate presented for the site is identified as R11; no further certificate details are available.

VirusTotal reports that 16 of 93 scanning engines have classified the domain as malicious, reinforcing the suspicion of malicious intent. No additional evidence such as page title, Safe Browsing status, or Open Threat Exchange identifiers have been published for this host. The limited visibility of the site, combined with its offline status, prevents direct observation of the payload or credential‑stealing mechanisms, leaving the exact phishing campaign details uncertain.

Defenders should continue to block traffic to 156.226.74.145 and add f7r2va.cn to URL filtering lists. Monitoring for re‑activation of the domain or reuse of the hosting IP is advised, as threat actors often resurrect offline infrastructure. Correlation with other indicators of compromise that reference the same IP or SSL fingerprint may aid in attributing future campaigns.