huitianmusic[.]com

This domain, huitianmusic.com, was taken offline as of the report date, July 24 2026, but forensic traces indicate it was actively used for a generic phishing campaign. The site presented the page title “汇天交易所”, which translates to “Huitian Exchange”, suggesting an attempt to lure victims into a fraudulent financial‑exchange portal. The domain was registered on February 24 2026 through Hello Internet Corp and delegated to Cloudflare nameservers amanda.ns.cloudflare.com and milan.ns.cloudflare.com. DNS resolution points to the IP address 104.21.84.38, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States.

No TLS certificate was observed; the service responded without HTTPS, which is consistent with many temporary phishing infrastructures that rely on HTTP to reduce setup cost. VirusTotal recorded five detections out of ninety‑three scanners, indicating that a minority of AV engines flagged the host as malicious at the time of the last scan. Independent blocklists have listed the domain, with PhishDestroy, MetaMask, and SEAL explicitly blocking it, and three additional security blocklists referencing it. The lack of a valid SSL certificate, combined with the short registration window and the Cloudflare front‑end, are typical of fast‑flux or throwaway phishing sites.

Defenders should add huitianmusic.com to network‑level deny lists, ensure DNS filtering solutions block the domain, and monitor for any resurgence of the same IP or similar Cloudflare‑hosted domains that reuse the “Huitian Exchange” branding. Continuous telemetry from endpoint protection and web‑gateway solutions should be tuned to flag URLs that resolve to 104.21.84.38, especially when accessed over HTTP. Because the site is currently offline, immediate containment actions are limited to preventive blocking, but threat‑intel teams should retain the domain’s indicators for correlation with future campaigns that may reuse the same infrastructure or branding.