huo[.]be

On June 1, 2024, PhishDestroy identified huo.be as an active generic phishing domain engineered to harvest credentials through QR code redirections. The domain exhibits low sophistication yet remains unclassified by major blocklists, suggesting active targeting of unsuspecting users. No specific brand impersonation or drainer kit linkage has been observed, though the domain's resolution pattern aligns with campaigns distributing malicious QR codes in public spaces and digital flyers. The threat remains under investigation due to its elevated risk classification and absence of detection signatures. Immediate attention is warranted to prevent widespread compromise.

Technical indicators reveal huo.be was registered on January 25, 2019, through an unspecified registrar and resolves to the IP address 54.215.31.113 via a Let’s Encrypt SSL certificate. VirusTotal currently flags the domain with a clean score of 3/95 detections, while Google Safe Browsing (GSB) has yet to categorize it as malicious. The domain has not been listed on any major threat intelligence platforms, underscoring its stealthy deployment and limited exposure. These conditions suggest a newly activated or resurfaced campaign, leveraging long-standing domains to evade automated detection.

As of this advisory, huo.be remains active and unblocked by standard defenses, with no confirmed takedown efforts in progress. Security teams are advised to implement network-level blocking for the IP address 54.215.31.113 and the domain itself, while monitoring for QR code-based lures associated with this infrastructure. The residual risk remains elevated due to the absence of detections and the domain’s seemingly legitimate SSL certificate. Users should treat any QR codes leading to huo.be with extreme caution and report suspicious activity to their SOC for immediate triage. Proactive hunting for similar domains registered in 2019 is recommended to preempt potential spillover campaigns.