mail[.]phone-locateshgkln[.]info

Analysis of mail.phone-locateshgkln.info indicates that the domain is currently active and has been classified as a generic phishing site. VirusTotal records show that six of ninety‑one security vendors have flagged the domain, providing an early indication of malicious intent. The domain resolves to the IPv4 address 96.125.163.17, which is the sole hosting indicator available.

The hosting host is not further identified in the supplied intelligence, and no registrar, ASN, or country information is present. Nameserver data is listed as NS_NOT_FOUND, suggesting that standard DNS delegation records are absent or could not be retrieved at the time of analysis. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the consensus that it should be treated as hostile.

No SSL/TLS certificate details, HTTP status codes, page title, or content analysis have been reported, leaving the surface‑web characteristics of the site unknown. Given the active status, the confirmed IP resolution, and the presence on at least one blocklist, defensive operators should proactively deny traffic to 96.125.163.17 and add mail.phone-locateshgkln.info to URL filtering rules. Continuous monitoring of the IP for any changes in reputation or additional vendor detections is advised, as is periodic re‑scanning to capture any new indicators that may emerge as the campaign evolves.