10007[.]vip

Analysis indicates that the domain 10007.vip is actively serving a phishing page as of July 25, 2026. The page title '导航' (Navigation) suggests an attempt to mimic a portal or directory service, though the exact content and targeted brand remain unconfirmed. The domain was registered on March 14, 2022, through Wild West Domains, Inc., and currently resolves to the IP address 45.138.71.205, hosted on AS35251 (NetLab Global) in the United States. Infrastructure analysis reveals Cloudflare nameservers (javier.ns.cloudflare.com and nucum.ns.cloudflare.com) and no SSL certificate, increasing the likelihood of interception or manipulation of unencrypted traffic.

Detection metrics show 17 of 93 security vendors on VirusTotal flagging the domain as malicious, while AlienVault OTX lists it in two threat intelligence pulses. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Scamadviser and Gridinsoft both assign trust scores of 1/100 and 0/100, respectively, reinforcing its high-risk classification. The HTTP status code 200 confirms the page is accessible, and no takedown or sinkholing has been observed.

Defenders should treat 10007.vip as a confirmed phishing domain. Recommended actions include blocking the domain and its resolving IP at perimeter security controls, updating endpoint detection rules to flag activity associated with this domain, and monitoring for connections to 45.138.71.205 or requests to the Cloudflare nameservers linked to this infrastructure. Given the lack of SSL, unencrypted traffic to this domain should be considered compromised. Further investigation into the page content and potential credential harvesting or malware distribution is advised, though no specific payload or campaign details are currently available.