client-zxb93nm870opqtz7[.]com

This domain, client-zxb93nm870opqtz7.com, is flagged as a credential theft operation targeting users through a fraudulent document submission portal. The page title 'Soumission de documents' suggests an attempt to impersonate a legitimate file-upload service, likely exploiting trust in government or corporate document handling systems. No specific brand impersonation or cryptocurrency drainer kit signatures were identified, but the domain exhibits characteristics consistent with credential harvesting infrastructure, including the use of Cloudflare for obfuscation and rapid deployment tactics. Analysis indicates the domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with short-lived malicious domains. It resolves to IP address 172.67.182.108, a Cloudflare-hosted endpoint, and employs HTTP/3 and Cloudflare Browser Insights for performance and tracking. VirusTotal detection shows 2/95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and was proactively blocked by at least one threat intelligence feed. The SSL certificate, issued by Google Trust Services, provides a false sense of legitimacy while masking the underlying malicious intent. As of the latest assessment, client-zxb93nm870opqtz7.com has been taken offline, likely due to rapid detection and response by security providers. However, the infrastructure remains a residual risk, as threat actors may re-deploy the domain or repurpose the IP for future campaigns. Organizations are advised to monitor for related indicators, including the registrar, IP range, and SSL issuer patterns. Users should verify document submission portals through official channels and avoid entering credentials on untrusted sites, even if they appear legitimate. The elevated risk designation reflects the domain's potential for rapid re-emergence and its alignment with credential theft tactics.