email[.]coolhair[.]com[.]cn

email.coolhair.com.cn was registered on February 21, 2026 through 广东时代互联科技有限公司. The authoritative name servers ns1.nowcndns.com and ns2.nowcndns.com resolve the domain to the IPv4 address 172.86.90.240, which is announced by AS14956 (RouterHosting LLC) and geolocated to the United States. No TLS certificate is presented, indicating the site is served only over HTTP. An HTTP request returns the default Apache2 Ubuntu page titled “Apache2 Ubuntu Default Page: It works”, which suggests a misconfigured web server rather than a crafted phishing landing page.

Nevertheless, multiple security services have flagged the domain. VirusTotal reports 18 of 93 scanners identifying malicious behavior, and Google Safe Browsing classifies the URL as a social‑engineering threat. The domain appears on one public blocklist and has been added to the PhishDestroy blocklist. Gridinsoft assigns a trust score of 0 out of 100, and the domain is currently listed as offline.

The combination of recent registration, low‑reputation hosting, lack of encryption, and multiple vendor detections points to a high‑risk phishing infrastructure despite the generic default page content. Defenders should continue to block the domain at network perimeter and DNS layers, monitor related IP 172.86.90.240 for any resurgence, and consider adding the name servers to watchlists. Because the site presently returns only a default server page, threat actors may be in the early stages of deployment or have withdrawn the payload, but the existing indicators warrant ongoing vigilance.