hls-3[.]cc

This domain is flagged as an AI-themed credential phishing site targeting users through deceptive interfaces labeled AI-BOT 5.0. Analysis indicates the infrastructure is designed to mimic legitimate AI service portals, harvesting login credentials, personal data, or financial details under the pretense of advanced automation tools. The page title AI-BOT 5.0 suggests an attempt to exploit interest in emerging technology to lower user vigilance and increase engagement with malicious content. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain hls-3.cc was registered on February 21, 2026, through Gname.com Pte. Ltd., an offshore registrar frequently associated with short-lived phishing domains. It resolves to IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic to mask origin infrastructure. The domain appears on two independent security blocklists and is flagged by 13 out of 95 security vendors on VirusTotal. Google Safe Browsing has classified it as phishing, and SSL certificates issued by Google Trust Services (WE1) do not mitigate the underlying malicious intent. Users who accessed hls-3.cc should immediately revoke any credentials entered on the site, especially if reused across other platforms. Monitor financial and identity activity for signs of compromise, such as unauthorized transactions or account lockouts. Clear browser caches and stored credentials related to the domain. Organizations should update endpoint protection rules to block the domain, IP, and associated SSL thumbprints. Given the domain’s current offline status, continued monitoring is advised as threat actors may re-deploy the infrastructure under new addresses or aliases.