h1[.]etop[.]click

Analysis indicates that the domain h1.etop.click was registered on August 30, 2025 through the Sav.com, LLC registrar and is hosted on a server located in the Netherlands under ASN 202412 (Omegatech LTD). The authoritative name servers are augustus.ns.cloudflare.com and laura.ns.cloudflare.com, which are typical of Cloudflare‑provided DNS. The domain resolves to the single IPv4 address 178.16.53.103; no TLS certificate is presented, meaning the site is reachable only over HTTP. The HTTP response returned the page title “Site is created successfully!”, a generic message that offers no indication of the intended victim‑facing content. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one public security blocklist.

VirusTotal scanned the host and 14 of 93 antivirus or URL‑reputation engines flagged the domain, confirming that multiple security vendors consider it malicious. PhishDestroy also listed the domain as blocked, reinforcing the classification as a phishing‑related threat. The current operational status is offline, which may be a temporary takedown or a deliberate shutdown after a campaign. Uncertainty remains regarding the exact phishing payload, the target brand, and whether the site ever delivered credential‑stealing forms before being taken offline. No evidence of a valid SSL certificate, content snapshots, or active phishing kits has been observed.

Defenders should proactively block the domain and its associated IP address at perimeter firewalls, DNS resolvers, and proxy filters. Because the hosting infrastructure is served through Cloudflare, additional monitoring of the Cloudflare name‑server entries for any future re‑use is advisable. Adding the domain to internal threat‑intelligence feeds and correlating any login‑related alerts with the observed IP can help surface lingering compromise attempts. Continuous re‑scanning of the IP address is recommended, as the host may be repurposed for other malicious activities.