xhvgmaco[.]click

This domain, xhvgmaco.click, is identified as a credential theft phishing site targeting users through a login interface labeled '登录,' indicating a focus on Chinese-speaking victims. The page likely mimics legitimate services to harvest usernames, passwords, and potentially multi-factor authentication codes, posing a direct risk of account compromise and unauthorized access to sensitive platforms such as email, financial services, or social media. Analysis of the domain infrastructure reveals multiple high-confidence indicators of malicious activity. The domain was registered on February 21, 2026, through Global Domain Group LLC and currently resolves to IP address 82.152.64.210, hosted by YUNYOO LTD (AS206300) in the United Kingdom. No SSL certificate is present, increasing the likelihood of interception or manipulation of transmitted data. The domain is flagged by 18 out of 95 security vendors on VirusTotal and appears on one security blocklist, confirming its classification as malicious by independent threat intelligence sources. Users who visited xhvgmaco.click or entered credentials on the site should immediately change passwords for all accounts where the same credentials may have been reused. Enable multi-factor authentication where available, and monitor accounts for unauthorized activity. If financial or sensitive personal information was submitted, consider placing a fraud alert on credit files and reviewing transaction histories for suspicious activity. Organizations should block the domain and associated IP at the network perimeter to prevent further exposure.