hawkfs[.]icu

The domain hawkfs.icu was registered on August 20, 2025 through Namecheap Inc and resolves to the IPv4 address 148.135.195.62, which is geolocated to Norway and belongs to AS212238 Datacamp Limited. DNS resolution is provided by dns1.registrar-servers.com and dns2.registrar-servers.com. The site presents a page titled "Authentication" and is secured with a Let's Encrypt certificate (YR1). As of the report date, the domain is taken offline, but historical evidence shows it was listed on a single security blocklist and actively blocked by PhishDestroy.

Gridinsoft assigns a trust score of 1 out of 100, reflecting an extreme lack of confidence in the host. VirusTotal analysis recorded detections from 2 of 91 security vendors, indicating that at least a small subset of scanners identified malicious characteristics. AlienVault OTX references the domain in one threat‑intelligence pulse, confirming that it has been observed in the broader security community. The limited detection footprint, combined with the low trust score, suggests the domain was used for a generic authentication‑style phishing campaign rather than targeting a specific brand.

Uncertainty remains regarding the exact phishing kit or victim demographic, as no brand name appears in the page title or other supplied metadata. Defenders should ensure the domain is added to network and endpoint blocklists, monitor the associated IP address for any re‑hosting activity, and consider instituting DNS‑sinkhole rules for the authoritative nameservers. Continuous vigilance is advised in case the domain is re‑registered or the underlying infrastructure is repurposed for future credential‑harvesting operations.