hnyhx[.]com

This domain is flagged as an active brand impersonation threat targeting Google users through a fraudulent login portal. Analysis indicates the site closely mimics Google's interface, including the page title 'Google,' to deceive visitors into entering sensitive credentials such as usernames, passwords, and potentially multi-factor authentication codes. The domain is designed to harvest login details for unauthorized account access, financial fraud, or further phishing campaigns targeting the victim's contacts or associated services. Infrastructure analysis reveals several technical indicators supporting its malicious intent. The domain hnyhx.com was registered on October 04, 2015, through Gname.com Pte. Ltd., a registrar frequently associated with suspicious domains. Despite its deceptive appearance, the domain has not been widely flagged, with 0 out of 95 security engines on VirusTotal detecting it as malicious. It resolves to the IP address 188.114.96.3 and employs technologies such as Google Web Server, HSTS, and HTTP/3, which are consistent with legitimate Google infrastructure. Notably, the domain uses an SSL certificate issued by Google Trust Services, further enhancing its credibility to unsuspecting users. Users who have visited hnyhx.com or entered credentials on the site should take immediate action to mitigate risks. First, reset passwords for any accounts accessed through the domain, prioritizing Google and email accounts. Enable multi-factor authentication using an authenticator app or hardware key, avoiding SMS-based methods if possible. Review account activity for unauthorized logins or changes, and revoke access to any suspicious third-party applications. Additionally, scan the device used to visit the site for malware, as credential theft pages may deploy additional payloads. Report the domain to security teams or threat intelligence platforms to aid in broader detection and takedown efforts.