houbey[.]vip

The domain houbey.vip was registered on August 13, 2025 through Gname.com Pte. Ltd. and resolves to the IP address 188.114.96.3, which is associated with AS13335 Cloudflare, Inc. in the United States. The site used Cloudflare’s nameservers carla.ns.cloudflare.com and vasilii.ns.cloudflare.com, but no SSL certificate was observed, indicating that HTTPS was not employed at the time of analysis. The page title returned by the server was "HASHKEY," a generic identifier that provides no insight into the intended target or content. Threat intelligence services have listed the domain on two blocklists—PhishDestroy and ScamSniffer—demonstrating that it is recognized as malicious by independent security communities.

Gridinsoft assigned the domain a trust score of 0 out of 100, reflecting a complete lack of trustworthiness. VirusTotal scans reported that seven of ninety‑five security vendors flagged the domain, reinforcing the suspicion of malicious activity. The domain is currently marked as offline, which may be a temporary takedown or a deliberate cessation of service. Defenders should continue to block the domain and its associated IP address, incorporate the host into internal threat feeds, and monitor for any re‑appearance or related infrastructure.

Because the site lacked TLS, any future re‑activation would be vulnerable to interception, and the presence on multiple blocklists suggests a pattern that may re‑emerge under different subdomains or hosting configurations. Continuous observation of the Cloudflare nameserver entries and periodic re‑scans with VirusTotal or similar platforms are advised to detect any resurgence. In the absence of additional content analysis, the available evidence—registration details, blocklist inclusion, trust score, and vendor detections—supports classifying houbey.vip as a confirmed phishing‑related threat.