heukax[.]com

PhishDestroy has flagged heukax.com as an active phishing domain designed to harvest credentials under the guise of a generic login portal. The domain leverages a recently issued SSL certificate from Let's Encrypt to appear legitimate, despite its fresh creation date of April 19, 2026. Analysis indicates the domain resolves to IP 104.21.14.161, a hosting infrastructure with a questionable reputation, and remains undetected by security vendors with 0 detections out of 95 scans on VirusTotal. heukax.com was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for accommodating high volumes of domain registrations with minimal verification. The domain's recent registration and rapid deployment of a phishing page suggest opportunistic abuse of newly registered domains (NRDs), a tactic frequently employed by threat actors to evade blocklists during their initial operational phase. While no blocklist entries have been confirmed at this time, the lack of detection underscores the need for proactive monitoring and user vigilance. Users who have accessed heukax.com should immediately verify any credentials entered on the site and consider them compromised. Clear browser cache and cookies associated with the domain, then perform a full antivirus scan to detect potential follow-on malware. Report the domain to your organization's security team or relevant abuse channels, and avoid interacting with similar recently registered domains pending further investigation. Monitor financial accounts and change passwords for other services if identical credentials were reused.