fenomor[.]com

This domain, fenomor.com, is currently flagged as an active generic phishing site under investigation as of July 12, 2026. Analysis indicates the domain was registered on February 21, 2026, through the registrar Hello Internet Corp, a provider frequently observed in recent phishing campaigns. The site resolves to the IP address 172.67.129.192, which is hosted on infrastructure belonging to AS13335, a network commonly used for content delivery and proxy services. The nameservers ns100.webnic.cc and ns101.webnic.cc are configured for this domain, a pairing that has been documented in prior malicious activity reports. The page title, 'FENOMOR | Open the world of luck and rewards!', suggests the site may be designed to lure users with promises of prizes or financial incentives, a tactic consistent with phishing or scam operations. However, the exact nature of the content and the intended target remain unconfirmed, as the site has not yet been widely detected by security vendors. As of the latest scan, only one security blocklist has flagged the domain, while no detections were recorded among 95 engines in a recent assessment. The absence of an SSL certificate further reduces the site's legitimacy, as encrypted connections are standard for genuine reward or promotional platforms. Infrastructure analysis reveals that the domain is still operational, returning an HTTP 200 status, which indicates active hosting. The use of proxy services may obscure the true origin of the threat actors, complicating attribution efforts. Defenders should treat this domain with caution, particularly in environments where users may be susceptible to reward-based social engineering. Network-level blocking is recommended until further analysis confirms the site's legitimacy or malicious intent. Monitoring for changes in detection status or additional blocklist inclusions is advised, as this may provide clearer indicators of compromise.