h5[.]spreadhen[.]top

The domain h5.spreadhen.top was registered on July 20 2026 through NameSilo, LLC and is currently resolved to the Cloudflare‑owned address 172.67.168.129. Its authoritative nameservers are becky.ns.cloudflare.com and conrad.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. The domain is classified as a high‑risk generic phishing campaign and remains active as of the report date, July 23 2026. It appears on one public security blocklist and has been explicitly blocked by the PhishDestroy sink‑hole.

VirusTotal analysis shows that one out of ninety‑one scanned security vendors flagged the domain, confirming at least one detection signal. No additional public intelligence such as page title, SSL certificate details, HTTP response codes, or content analysis is presently available, leaving the exact phishing payload and targeted brand undefined. The limited detection footprint suggests that the campaign may be in an early deployment stage or that automated scanners have not yet fully indexed the site. Defenders should immediately add h5.spreadhen.top and its resolved IP 172.67.168.129 to network‑level deny lists, enforce DNS filtering for the associated Cloudflare nameservers, and monitor any outbound connections to the address.

Continuous re‑scanning of the domain on VirusTotal and other sandboxes is advised to capture evolving indicators. Correlation with internal logs for any authentication attempts to the domain or connections to the IP should be performed, and any compromised credentials should be rotated. Because the underlying hosting is Cloudflare, any takedown request must be routed through Cloudflare’s abuse channels, referencing the observed blocklist entry and the PhishDestroy detection. Ongoing vigilance is required given the domain’s recent creation and active status.