huayansi[.]com

Analysis indicates that the domain huayansi.com was registered on March 11 2026 through West263 International Limited. The domain resolves to four authoritative name servers operated by MyHostAdmin (ns1‑ns4.myhostadmin.net). HTTP requests to the host return a 200 OK status, suggesting that a web service was active before the domain was taken offline. Threat intelligence shows that the site was identified as part of a generic phishing campaign and has been added to three public blocklists.

It is also listed in the PhishDestroy, MetaMask, and SEAL blocklists, confirming cross‑vendor detection. VirusTotal scans report a single positive detection out of ninety‑four scanners, reinforcing the suspicion of malicious intent. The domain currently appears offline, which may be the result of takedown actions or the operator shutting down the infrastructure. Evidence gaps remain: no public IP address or autonomous system information is supplied, SSL/TLS certificates have not been disclosed, and no page title or content hash is available for further correlation.

Consequently, the full scope of the phishing infrastructure, including any command‑and‑control servers or credential‑harvesting pages, cannot be established from the present data. Defenders should continue to monitor the domain and its name‑server set for re‑activation, enforce blocklist entries in perimeter security devices, and ensure that any inbound traffic to huayansi.com is denied. Incident response teams should also review logs for connections to the listed name servers during the active window and correlate any captured credential submissions with known phishing kits. Because the domain is already flagged by multiple reputable blocklists, adding it to internal deny lists is a prudent mitigation step.