heymanyu[.]co

Analysis of heymanyu.co shows a newly registered domain created on February 21, 2026 that was linked to a wallet/seed phishing campaign targeting the brand across. The domain resolves to IP address 185.214.74.84, which is assigned to AS215540 GLOBAL CONNECTIVITY SOLUTIONS LLP in the Netherlands. Hosting details indicate the use of generic suspension‑related nameservers (NS1.SUSPENDED-DOMAIN.COM, NS2.SUSPENDED-DOMAIN.COM).

The site was secured with an SSL certificate rated R10, reflecting a low trust level, and the registrar listed is PDR Ltd. d/b/a PublicDomainRegistry.com. Security monitoring services have flagged the domain on two blocklists, specifically PhishDestroy and ScamSniffer, and VirusTotal reports three of ninety‑five antivirus engines detecting malicious activity. The Gridinsoft trust score is recorded as 0 out of 100, reinforcing the suspicion of malicious intent.

The page title returned from the live probe is "Manyu," but no further content analysis is available because the domain is currently taken offline. Defenders should treat heymanyu.co as a confirmed malicious infrastructure element: block the domain and its resolved IP at perimeter defenses, add the associated nameservers to deny lists, and monitor for any re‑registration or similar patterns. Continued vigilance is advised, particularly for any credential‑capture or seed‑extraction attempts that may reuse this infrastructure.