hengyitong[.]com[.]cn

This domain, hengyitong.com.cn, operates as a credential harvesting portal designed to mimic legitimate corporate login pages. Analysis indicates the site employs form-based phishing techniques to capture usernames, passwords, and potentially multi-factor authentication tokens. The infrastructure is optimized for rapid deployment and evasion, with no SSL certificate to avoid certificate transparency logs and reduce detection likelihood. The site's design suggests targeting of enterprise users, likely through spear-phishing campaigns distributing direct links to the domain. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain resolves to IP address 64.32.8.173, hosted on a provider known for bulletproof hosting services. VirusTotal detection rates show 14 out of 95 security vendors flagging the domain as malicious, with specific classifications including phishing and credential theft. The domain was registered on May 22, 2026, through a Chinese registrar, with the creation date potentially manipulated to appear legitimate. The domain appears on one security blocklist, specifically PhishDestroy, and is currently offline, suggesting either takedown or operational pause. Users who visited hengyitong.com.cn should immediately reset credentials for any accounts accessed through the site, particularly corporate or email accounts. Enable multi-factor authentication on all critical services and monitor accounts for unauthorized access attempts. Organizations should block the domain and IP address 64.32.8.173 at the network perimeter. Security teams should analyze endpoint logs for connections to the domain and IP, checking for successful credential submissions. Given the elevated risk level, affected users should consider password manager audits and credit monitoring if financial information was exposed.