ngehw2hng282489[.]com

The domain ngehw2hng282489.com is currently classified as a high‑risk generic phishing site. Infrastructure analysis shows the domain resolves to the IPv4 address 31.7.56.59, which is hosted in Switzerland under the Cyber Locker Switzerland S.A. entity. Registration records list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar, and the authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. The site presents an HTTP 200 response and serves a TLS certificate issued by Let’s Encrypt (common name YE1). The page title returned is a single dollar sign ($), and no further content has been publicly disclosed. Threat intelligence sources indicate the domain has been blocked by PhishDestroy and appears on at least one security blocklist. VirusTotal scans have flagged the domain in 5 of 91 security engines, and AlienVault OTX references the domain in two separate pulses. These indicators collectively confirm active malicious use. Defenders should add the domain and its resolved IP to outbound and inbound filtering rules, monitor DNS queries for the associated name servers, and consider sharing the indicator set with upstream threat‑sharing communities. Continuous re‑evaluation is advised, as additional payload or credential‑harvesting pages may be deployed without notice.