nj[.]com-hetpayse[.]cc

The domain nj.com-hetpayse.cc was registered on September 27, 2025 through Dominet (HK) Limited and currently resolves to the IP address 104.21.44.15. Analysis indicates that the domain is actively being used for credential harvesting, as evidenced by its classification as a generic phishing campaign and its inclusion on a security blocklist. The blocklist entry is confirmed by PhishDestroy, which has explicitly blocked the domain. VirusTotal scans show that 7 out of 91 security vendors have flagged the domain as malicious, reinforcing the suspicion of malicious intent.

The domain appears on one additional security blocklist, suggesting limited but notable exposure within threat intelligence feeds. No further public metadata such as SSL certificate details, HTTP response codes, or page titles have been disclosed, leaving the exact content of the hosted page unverified. The infrastructure footprint is narrow, with a single IP address and a solitary registrar record, simplifying attribution and mitigation.

Defenders should prioritize adding nj.com-hetpayse.cc to network and endpoint deny lists, enforce DNS filtering, and monitor outbound connections to the associated IP range. Continuous re‑evaluation of detection vendor feeds is advised, as additional flags may emerge as the campaign evolves. Organizations should also consider reviewing authentication logs for any attempted logins originating from the identified IP, and enforce multi‑factor authentication to mitigate credential compromise risk.