tyhuojia[.]com

Analysis of tyhuojia.com indicates a high-risk generic phishing domain active as of July 12, 2026. The domain was registered on March 13, 2026, through West263 International Limited and currently resolves to IP address 172.247.72.189. It is flagged by two security blocklists and appears in 24 threat intelligence pulses on AlienVault OTX, confirming its malicious classification. The domain remains operational, with a Let's Encrypt SSL certificate in place, suggesting encrypted communication channels are being utilized. Technical indicators reveal the use of Bootstrap, Nginx, OpenResty, Slick, jQuery, and HSTS, which are common in both legitimate and malicious web infrastructure. The page title is listed as 'Home,' but no further content analysis has been conducted to determine the specific phishing target or lure. Three out of 95 security vendors on VirusTotal have detected this domain as malicious, though this number may not reflect its full risk profile due to potential delays in vendor updates or detection coverage. Defenders should treat this domain as an active threat. Immediate actions include blocking the domain and its associated IP (172.247.72.189) at the network perimeter, monitoring for any internal connections to it, and reviewing logs for prior interactions. Given its presence on multiple blocklists and in threat intelligence feeds, this domain is likely part of a broader phishing campaign. Further investigation into its hosting infrastructure and any linked domains may provide additional context for mitigation efforts.