Analysis indicates that the domain hckej75392.com was registered on 21 October 2025 through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn). The authoritative name servers are dns29.hichina.com and dns30.hichina.com, both operated by the same registrar. DNS resolution points to the IPv4 address 8.155.144.129, which is hosted by Alibaba.com LLC and geolocated to the People’s Republic of China. The domain appears on three public blocklists and is currently listed by PhishDestroy, MetaMask, and SEAL, confirming that multiple security services have identified it as malicious.
VirusTotal has processed the domain with 91 scanning engines, reporting no detections; however, the lack of detections does not constitute evidence of benign behavior. The threat classification is recorded as generic phishing, and the risk level is marked high. The domain remains active as of the report date, 28 July 2026. Concrete evidence about the page content, SSL certificate, HTTP response codes, or brand impersonation is not available in the current intelligence set, leaving the exact phishing vector uncertain.
Defenders are advised to continue blocking the domain at network perimeters, update intrusion detection signatures with the observed IP and name‑server pair, and monitor for any new traffic patterns associated with the 8.155.144.129 host. Additional investigation, such as URL crawling and payload analysis, should be prioritized to determine the specific credential‑stealing mechanisms employed. Continuous re‑evaluation is recommended given the active status and high risk rating.