hyen[.]trade

The domain hyen.trade was a phishing site engaged in brand impersonation targeting Google. It presented itself as an official Google page to deceive users into entering credentials or other sensitive information, posing an elevated risk of account compromise. No crypto drainer kit was detected, and the site is currently taken offline.

Technical indicators confirm hyen.trade as malicious. As of analysis, 2 of 95 VirusTotal security vendors flagged the domain, including Fortinet and SOCRadar. The domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, and resolved to the IP address 104.21.67.193, hosted on Cloudflare's network (AS13335). It appeared on 1 security blocklist (PhishDestroy) and used an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'Google', and technologies detected included Google Web Server, HSTS, and HTTP/3. Nameservers were lauryn.ns.cloudflare.com and anuj.ns.cloudflare.com.

Users who interacted with hyen.trade should immediately change their Google account passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google via their phishing reporting tool and to platforms like PhishTank or the Anti-Phishing Working Group (APWG) to aid in takedown efforts. If financial or crypto accounts were accessed, contact the respective service providers to secure funds and review transaction histories.