6h361[.]com

Analysis of the domain 6h361.com indicates active phishing infrastructure targeting Chinese-speaking users. The domain, registered on October 12, 2019, remains operational as of July 12, 2026, resolving to IP 156.234.227.174 (AS138415, Hong Kong). The page title '欢迎' (Welcome) suggests a localized phishing attempt, though the exact content or targeted brand is not confirmed in available data. Infrastructure uses Cloudflare nameservers (javier.ns.cloudflare.com, nucum.ns.cloudflare.com) and an Nginx web server with a Let's Encrypt SSL certificate (E8). Security vendors flag the domain with moderate consensus: 21 of 95 engines on VirusTotal detect malicious activity, and it appears on two blocklists (PhishDestroy, PhishingDB). AlienVault OTX records the domain in 17 threat intelligence pulses, reinforcing its association with phishing campaigns. Trust scores from Gridinsoft and Scamadviser both rate the domain at 1/100, indicating high risk. Defenders should prioritize blocking 6h361.com at DNS and web proxy layers, particularly in regions with Chinese-speaking users. The domain's six-year registration age and continued Cloudflare hosting suggest persistent adversary infrastructure. No evidence confirms the use of phishing kits or specific credential-harvesting techniques, but the combination of Chinese-language indicators, active SSL, and consistent detection warrants immediate containment. Further analysis of network traffic to 156.234.227.174 may reveal additional linked domains or campaign patterns.