6h605[.]com

Analysis indicates that 6h605.com is a high-risk domain exhibiting characteristics consistent with phishing activity. Registered on February 21, 2026, through GoDaddy.com, LLC, the domain remains active as of July 12, 2026. It resolves to IP address 154.205.9.182, hosted on AS132813 (HK AISI CLOUD COMPUTING LIMITED) in Hong Kong. The page title, '快捷导航 - 您的上网入口' (translated as 'Quick Navigation - Your Internet Portal'), suggests a generic gateway or redirect service, a common tactic in phishing campaigns to obscure malicious intent. Infrastructure analysis reveals the use of Nginx and OpenResty, technologies frequently employed in both legitimate and malicious web services. The domain is served over HTTPS with a Let's Encrypt certificate (serial E8), which does not inherently indicate trustworthiness. Nameservers are configured to Cloudflare (sage.ns.cloudflare.com, surina.ns.cloudflare.com), a practice observed in both benign and malicious domains to leverage Cloudflare's proxy services for anonymity. Threat intelligence sources provide strong indicators of compromise. AlienVault OTX lists 6h605.com in 17 distinct threat pulses, and the domain appears on at least two security blocklists, including PhishDestroy and PhishingDB. While VirusTotal reports 22 detections out of 93 security vendors, this does not constitute definitive proof of malicious activity but aligns with broader suspicion. Gridinsoft assigns a trust score of 0/100, further corroborating the domain's high-risk classification. Defenders should treat this domain as actively malicious. Recommended actions include blocking DNS resolution to 154.205.9.182, monitoring for connections to the domain in network logs, and investigating any endpoints that have interacted with it. The exact phishing lure or target remains unconfirmed, as the page content has not been analyzed. However, the combination of technical indicators, threat intelligence, and infrastructure patterns strongly suggests malicious intent.