huitiancomputer[.]com

Analysis of huitiancomputer.com confirms its classification as an active phishing domain targeting cryptocurrency exchange users. The domain was registered on June 15, 2026, through West263 International Limited, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals Cloudflare nameservers (amanda.ns.cloudflare.com and milan.ns.cloudflare.com) and resolution to IP address 188.114.97.3, located in Canada under Cloudflare, Inc. This configuration is consistent with threat actors leveraging Cloudflare's services to obscure hosting origins and evade takedown efforts. The page title, '汇天交易所' (translated as 'Huitian Exchange'), directly indicates the site's fraudulent intent to mimic a legitimate cryptocurrency exchange platform. As of July 12, 2026, the domain remains operational, returning an HTTP 200 status code, and is actively blocked by three security vendors: PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. Eleven of 91 security vendors on VirusTotal flag the domain, though the specific detection rules and signatures are not publicly disclosed. The SSL certificate, issued by Let's Encrypt (serial number YE1), provides HTTPS encryption but does not validate the site's legitimacy. The domain's registration age (less than one month at the time of analysis) aligns with typical phishing campaign lifecycles, where domains are rapidly deployed and discarded. No evidence of a phishing kit or specific payload has been publicly documented, though the site's structure and intent are consistent with credential harvesting or fraudulent transaction schemes. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments handling cryptocurrency transactions.