hotejka[.]ink

Analysis of hotejka.ink shows a high‑risk credential phishing operation that is currently active. The site returns an HTTP 302 status, indicating a redirect that may be used to forward victims to a credential‑collection endpoint. Infrastructure profiling reveals the domain is served through Cloudflare (ASN 13335) with IPv6 address 2a06:98c1:3120::3, and both chance.ns.cloudflare.com and reza.ns.cloudflare.com are listed as authoritative nameservers. The presence of Cloudflare Browser Insights and HTTP/3 suggests a modern web stack, while the underlying application appears to be built with PHP. TLS termination is provided by Google Trust Services under the WE1 certificate, confirming a valid, widely‑trusted certificate chain.

Email routing points to mx.yandex.net (priority 10), a common choice for disposable or compromised mail setups. Reputation data is unfavorable: Gridinsoft assigns a trust score of 0 / 100, and two of ninety‑five VirusTotal scanners flag the domain. It is listed on a single security blocklist and is actively blocked by PhishDestroy, reinforcing the malicious classification. The page title captured during the scan is "Un instant…", offering no direct indication of the targeted brand or service.

Registration details show the domain was created on 18 February 2021 through Porkbun LLC, a registrar that does not inherently imply malicious intent but provides an older window for potential abuse. Defenders should treat any URLs referencing hotejka.ink as malicious, block the domain at the DNS and proxy layers, and monitor outbound traffic for connections to the Cloudflare‑hosted IP range. Email filters should flag messages referencing the Yandex MX host, and any credential‑submission attempts redirected to hotejka.ink should be logged and investigated. Continuous re‑evaluation is advised, as additional indicators such as content changes or new detections may emerge.