mail[.]hashflow[.]online

The domain mail.hashflow.online was registered on July 27, 2026 through Namecheap Inc. The authoritative nameservers are dns1.namecheaphosting.com and dns2.namecheaphosting.com, and DNS resolution points to the IPv4 address 198.187.31.225. The domain appears on three independent security blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services, indicating that multiple threat‑intelligence feeds have identified it as malicious. A VirusTotal scan performed by 91 anti‑malware vendors returned no detections; however, the absence of detections does not constitute evidence of safety, and the domain remains classified as high‑risk phishing infrastructure.

No public page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts are currently available, so the exact content served by the site has not been publicly disclosed. Likewise, there is no evidence of attribution to a known phishing kit or affiliation with a specific brand. The limited observable data – recent creation date, use of Namecheap hosting, and rapid addition to blocklists – suggests a short‑lived, purpose‑built phishing operation.

Defenders should continue to block traffic to mail.hashflow.online at the network perimeter, monitor DNS queries for this FQDN, and consider adding the associated IP address 198.187.31.225 to deny‑list rules. Ongoing observation for any changes in hosting, SSL deployment, or page content is recommended to update detection signatures promptly.