zh-proton-vpn[.]hl[.]cn

The domain zh-proton-vpn.hl.cn poses a significant threat categorized as generic phishing. This domain attempts to impersonate a legitimate VPN service, likely to harvest credentials or personal information from unsuspecting users. The impersonation tactic can mislead individuals into providing their login details under the false pretense of a secure service.

Evidence of malicious intent is substantiated by the fact that the domain was created on May 25, 2026, suggesting an ongoing operation as it is still active. VirusTotal analysis indicates that the domain has been flagged by 15 out of 95 security vendors, which raises concerns about its credibility and potential to distribute malicious content. It is registered through 浙江贰贰网络有限公司, with the IP address resolving to 45.138.68.230, further establishing its association with potentially harmful activities.

Users who have visited this domain should take immediate action to protect their personal information. It is advisable to change any passwords that may have been compromised and enable two-factor authentication where applicable. Users should also monitor their financial accounts for any unauthorized transactions and consider running a scan on their devices using reputable antivirus software to check for any malware that may have been inadvertently downloaded.