caixadecatalunya[.]com

This domain, caixadecatalunya.com, is flagged as a generic phishing site impersonating the official AC Milan sports platform, targeting Chinese-speaking users. The page title, 米兰体育·网站登录入口-米兰online(中国), directly translates to "AC Milan Sports · Website Login Portal - Milan Online (China)," indicating an attempt to deceive users into entering credentials under the guise of a legitimate sports login page. No crypto drainer or payment skimmer components were identified, but the infrastructure aligns with credential harvesting tactics commonly used in sports-related phishing campaigns.

Analysis reveals the domain was registered on June 11, 2026, through Longming Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 166.75.117.36 and employs technologies such as Bootstrap, Nginx, jQuery, HSTS, and Baidu Analytics (百度统计), alongside HTTP/3 for improved performance and evasion. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while AlienVault OTX lists it in two threat intelligence pulses. The domain appears on one security blocklist, and its Gridinsoft trust score is 0/100, further confirming its malicious nature. No Google Safe Browsing (GSB) entries were found at the time of analysis.

The domain is currently offline, likely taken down due to detection by security vendors or hosting provider intervention. However, residual risk remains, as threat actors may re-deploy the infrastructure under a new domain or IP address. Users who interacted with the site should assume credential compromise and rotate passwords immediately. Organizations are advised to monitor for similar phishing domains using the same registrar or IP range, as this infrastructure may be reused in future campaigns.