henofex[.]com

PhishDestroy identifies henofex.com as an active credential-harvesting domain designed to mimic legitimate login interfaces, posing an elevated risk to unsuspecting users. This domain operates without affiliation to any known brand, functioning as a standalone phishing infrastructure. There are no indications this domain leverages a drainer kit; instead, it likely relies on deception via deceptive web forms to capture user credentials. The domain was flagged by 5 out of 95 security vendors on VirusTotal, indicating limited but notable detection coverage.

Technical indicators associated with this domain include a VirusTotal detection score of 5/95, a creation date of April 09, 2026, and resolution to IP 188.114.97.3. The domain is registered through Fewmoretaps OU d/b/a Trustname.com and secured with a Let’s Encrypt SSL certificate. Based on available intelligence, this domain has not been flagged by Google Safe Browsing, and the current blocklist count remains unspecified.

This domain remains active, presenting an ongoing risk to users who may accidentally interact with it. Organizations are advised to implement network-level blocking for the domain and IP address. Users should verify website authenticity before entering credentials and report any suspicious activity. While detection remains partial, proactive measures can mitigate exposure to this threat. The residual risk remains elevated due to the domain’s recent creation and active status.