6h335[.]com

This domain, 6h335.com, operates as a credential theft portal specifically targeting Chinese-speaking users, as evidenced by its page title '欢迎' (Welcome) and localized content structure. Analysis indicates the site was designed to harvest login credentials, likely for financial or social media accounts, through deceptive login prompts or fake authentication interfaces. The absence of SSL encryption further suggests an intent to intercept unencrypted data submissions, a common tactic in credential harvesting campaigns. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on March 24, 2024, through Gname.com Pte. Ltd., a registrar frequently associated with short-lived phishing domains. It resolves to the IP address 156.234.227.171, hosted under AS138415 (Yancy Limited) in Hong Kong, a network segment with a history of hosting fraudulent infrastructure. Security vendors have flagged the domain in 17 out of 95 detection engines on VirusTotal, while independent blocklists such as PhishDestroy and PhishingDB have listed it, contributing to its presence on 2 security blocklists. The domain’s current offline status suggests takedown action, though its infrastructure may be repurposed. Users who visited 6h335.com should assume their credentials were compromised if any information was entered. Immediate steps include resetting passwords for all accounts accessed from the same device or network during the exposure window, particularly those tied to financial services or email. Multi-factor authentication (MFA) should be enabled where available to mitigate unauthorized access. Devices used to visit the domain should undergo a full security scan to detect potential secondary infections, such as keyloggers or browser-based malware. Monitoring for unauthorized transactions or account activity is critical, as harvested credentials are often sold or exploited within hours of collection.