tranhdonghoxinh[.]com

This domain, tranhdonghoxinh.com, was identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. Such sites often mimic legitimate services, tricking visitors into entering usernames, passwords, or financial details, which are then captured by threat actors for fraudulent use. The site's current offline status does not eliminate the risk, as domains of this nature frequently reappear under different infrastructure or remain dormant to evade detection. Analysis indicates this domain was registered on March 28, 2025, through Gname.com Pte. Ltd., a registrar commonly associated with abusive domains. It is flagged by 18 out of 95 security vendors on VirusTotal, with additional listings on two security blocklists, including PhishDestroy and PhishingDB. The domain resolves to 104.21.47.2, an IP address hosted on Cloudflare's network, which is frequently leveraged to obscure malicious infrastructure. Despite displaying a placeholder page titled '网站筹建中' (Website Under Construction), historical or cached versions may reveal active phishing content. Users who visited tranhdonghoxinh.com should assume their credentials or personal information may have been compromised. Immediate steps include changing passwords for any accounts accessed while on the site, enabling multi-factor authentication where available, and monitoring financial statements for unauthorized activity. If login details were entered, consider revoking active sessions on associated services and scanning devices for malware. Organizations should block the domain and its resolving IP at the network level to prevent further exposure. Given the domain's recent creation and offline status, ongoing vigilance is recommended, as threat actors may reactivate it or deploy similar infrastructure.