hutie[.]tw

Analysis as of July 22, 2026 identifies the domain hutie.tw as an active generic phishing infrastructure. The domain was registered through GANDI SAS on July 20, 2024 and resolves to the IPv4 address 188.114.96.3. Its authoritative name servers are listed as james.ns.cloudflare.com (appearing twice) and a partially recorded magdalena.ns.clou entry, indicating Cloudflare‑based DNS resolution. The domain is currently listed on a single security blocklist and is blocked by the PhishDestroy feed, confirming that at least one external mitigation service has observed malicious use.

VirusTotal records show that the domain was scanned by 95 antivirus and URL‑reputation vendors; none of the scanners reported a detection at the time of the scan. While the lack of detections does not constitute evidence of benign behavior, it demonstrates that the domain has not yet triggered automated signatures in the evaluated engines. No public SSL certificate details, HTTP response codes, or page‑title metadata have been published in the available intelligence, leaving those vectors unverified.

Consequently, the confidence in the domain’s malicious intent rests on the registration age, hosting profile, blocklist presence, and the classification of “generic phishing” supplied by the reporting source. Defenders should consider adding hutie.tw to inbound and outbound filtering rules, monitor DNS queries for resolution to 188.114.96.3, and incorporate the domain into threat‑intel feeds that ingest PhishDestroy data. Continuous observation of any future VirusTotal scans, additional blocklist listings, or emergence of page‑level indicators will be required to refine the risk assessment.