hilofet[.]com

The domain hilofet.com is currently active and classified as a high‑risk generic phishing site. Technical analysis shows the domain resolves to the Cloudflare‑hosted IP address 172.67.166.184, located in Canada. The site presents an HTTP 521 status code, indicating a web server error, and the page title returned is "hilofet.com | 521: Web server is down." TLS is provided by a Let’s Encrypt certificate (issuer YE1). DNS resolution uses the Cloudflare nameservers beau.ns.cloudflare.com and hera.ns.cloudflare.com. The domain is listed on one public security blocklist and is actively blocked by the PhishDestroy service. VirusTotal scans have flagged the domain by 20 of 91 security vendors, and AlienVault OTX shows the domain appears in 11 threat‑intelligence pulses. Registration details list CNOBIN INFORMATION TECHNOLOGY LIMITED as the registrar. No evidence has been observed regarding the specific brand or service being spoofed, and the actual page content has not been captured; therefore the exact victim‑targeting vector remains uncertain. Defenders should add hilofet.com to network‑level deny lists, monitor DNS queries for the associated IP, and ensure endpoint protection solutions are updated to reflect the 20 vendor detections. Continuous threat‑intel correlation is advised to capture any future changes in the domain’s payload or targeting.