huashengdeili[.]com

Analysis indicates that huashengdeili.com was registered on 21 February 2026 through Gname.com Pte. Ltd. The domain resolves to the IPv4 address 172.245.67.31, which belongs to the HostPapa network (AS36352) located in the United States. The site presented a page titled “花生代理 - iP代理_动态iP_全国代理iP_换IP软件_ip地址修改器” and employed a Let’s Encrypt R12 certificate for HTTPS connections. The hosting infrastructure is served by the shared DNS providers a10.share-dns.com and b10.share-dns.net.

Security monitoring tools have identified the domain as malicious: it appears on the PhishDestroy blocklist, has a Gridinsoft trust score of zero out of one hundred, and one out of ninety‑three VirusTotal scanners flagged it as a threat. The domain is currently taken offline, but its prior activity suggests a generic phishing campaign, likely aimed at luring victims into providing credentials or installing proxy‑related tools. The limited detection footprint—only a single blocklist entry and a single vendor flag—means that broader visibility may be lacking, and the exact phishing payload or target page has not been publicly disclosed.

Defenders should proactively block the domain and its associated IP address at network perimeter and endpoint layers, add the nameservers to watch lists, and monitor for any re‑registration attempts. Given the SSL certificate is publicly trusted, inspection of TLS traffic for this host is recommended to catch any residual malicious exchanges. Continuous threat‑intel feeds should be consulted for updates, as the domain could be re‑activated or repurposed by the same adversary group.