hoanax[.]com

hoanax.com was registered on March 11, 2026 through Gname.com Pte. Ltd. and is currently active. DNS resolution points to 142.251.154.119, an address owned by AS13335 Cloudflare, Inc. in the United States. The site returns HTTP status 200 and presents a page titled "Google Chrome – The Fast and Secure Web Browser Built to be Yours," a clear attempt to mimic a legitimate brand. The authoritative nameservers are john.ns.cloudflare.com and natasha.ns.cloudflare.com, confirming Cloudflare’s role as the DNS and CDN provider.

Infrastructure analysis shows the domain is listed on a single security blocklist and has been flagged by PhishDestroy. VirusTotal scans indicate that only 2 of 95 security vendors have identified the domain as malicious, suggesting limited visibility in broader threat feeds. The site’s Gridinsoft trust score is 1 out of 100, reflecting an extremely low reputation. The observed phishing kit is identified as the Gambler Scam, commonly associated with cryptocurrency‑focused fraud.

While the low vendor detection count and minimal blocklist presence could be interpreted as a nascent campaign, the combination of a brand‑impersonation page title, a known phishing kit, and a trust score of 1/100 provides strong evidence of malicious intent. The primary uncertainty lies in the scope of victim exposure, as current data does not disclose the volume of phishing emails or the specific cryptocurrency assets being targeted. Nonetheless, the presence of a high‑risk brand impersonation vector warrants immediate attention.

Defenders should add hoanax.com to outbound and inbound filtering policies and monitor DNS queries for the associated Cloudflare nameservers. Network sensors should flag any HTTP traffic to the IP 142.251.154.119, especially requests that include the observed page title. Continuous re‑evaluation of detection feeds is advised, as additional security vendors may raise their detection counts as the campaign matures.