hzknyy[.]net

Analysis of the domain hzknyy.net confirms its classification as a high-risk phishing site targeting users of the Argent cryptocurrency wallet. Registered on October 24, 2024, through Gname.com Pte. Ltd., the domain was taken offline by July 23, 2026, but remains a documented threat. Infrastructure analysis reveals the domain resolved to the IP address 43.160.249.32, hosted on AS132203 within Tencent’s network in Singapore. No SSL certificate was present, increasing the likelihood of unencrypted credential harvesting. Detection data supports the malicious classification: 17 of 95 security vendors on VirusTotal flagged the domain, and it appears on one security blocklist, including PhishDestroy.

Google Safe Browsing explicitly labeled the site as engaging in social engineering. AlienVault OTX includes the domain in four threat intelligence pulses, indicating prior malicious activity. The page title, 'WhatsApp,' does not align with the confirmed brand impersonation of Argent, suggesting either a generic lure or a misconfigured phishing kit. Nameserver records (a.share-dns.com, a3.share-dns.com, b.share-dns.net, b3.share-dns.net) are consistent with bulletproof or low-reputation DNS providers, often reused across phishing campaigns. The Gridinsoft trust score of 0/100 further corroborates the domain’s malicious intent.

While the exact content and functionality of the site remain unanalyzed, the combination of brand impersonation, detection by multiple security vendors, and inclusion in threat intelligence feeds provides sufficient evidence for defenders to block or monitor the domain. Defenders should treat this domain as confirmed malicious infrastructure, particularly in environments where Argent wallet users are present. Historical resolution data and associated IP addresses should be cross-referenced for additional indicators of compromise. Given the domain’s current offline status, monitoring for re-registration or reuse of its infrastructure is recommended.