he92kc[.]xyz

The domain he92kc.xyz, now offline, was identified as a phishing threat shortly after its creation on June 18, 2026. Despite being flagged by only 2 out of 91 vendors on VirusTotal, PhishDestroy quickly recognized its malicious nature, adding it to public blocklists on June 20, 2026. This highlights the domain's rapid deployment within the critical 24-72 hour window post-registration, a period often exploited by threat actors to bypass traditional security measures.

Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, he92kc.xyz was hosted on an IP associated with Cloudflare, Inc. in the United States. The use of a reputable SSL issuer, Google Trust Services, suggests an attempt to lend credibility to the phishing operation. The platform risk score of 66 out of 100 indicates a significant threat level, reinforcing the importance of early detection systems in identifying and mitigating such risks.

The swift takedown of he92kc.xyz underscores the effectiveness of proactive threat intelligence in neutralizing phishing domains before they can cause widespread harm. By capturing threats during the pre-detection window, PhishDestroy's pipeline provides a crucial layer of defense against emerging phishing schemes. This case serves as a reminder of the ongoing need for vigilance and timely intervention in the ever-evolving landscape of cyber threats.