h[.]buahceri[.]shop

Analysis of the domain h.buahceri.shop indicates that it is currently operating as a phishing infrastructure. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed, confirming that threat‑intelligence communities have identified it as malicious. DNS resolution points to the IP address 172.67.220.56; no authoritative nameserver records were returned, which limits deeper zone‑level investigation.

VirusTotal records show that the domain was scanned by 91 antivirus and URL‑reputation vendors, none of which flagged it at the time of scanning. While the absence of detections does not constitute a safety guarantee, the combined presence on a blocklist and active blocklist feed outweighs the clean vendor scores. No additional data such as registrar details, SSL certificate information, HTTP response codes, trust‑score metrics, page title, or external evidence links were provided, leaving the content and exact phishing lure unknown.

The domain status is listed as active, meaning it continues to resolve and potentially serve malicious payloads. Defenders should add h.buahceri.shop to network and endpoint deny lists, enforce DNS‑level blocking, and consider sinkholing or monitoring traffic to the associated IP 172.67.220.56 for anomalous activity. Continuous re‑evaluation is advised, as future scans or threat‑feed updates may reveal new indicators of compromise.