allinx-ko[.]com

This domain is flagged as a high-risk credential theft operation targeting users of the AllInX platform. Analysis of the page title, "9. AllInX 로그인 | 안전한 계정 관리 및 거래 시작," indicates an attempt to impersonate the legitimate AllInX login interface, tricking users into submitting account credentials. The threat type is narrowly defined as credential theft, not generic phishing, due to the targeted replication of a cryptocurrency service login portal. Infrastructure analysis reveals multiple indicators of malicious activity. The domain resolves to the IP address 186.2.175.79 and was registered through Gname.com Pte. Ltd. on May 31, 2026, an anomalous future date suggesting registry manipulation. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy. Only 1 of 95 security vendors on VirusTotal currently flag the domain, demonstrating low detection rates despite its active status. No reputable blocklists or trust scores currently list the domain, further complicating automated detection. Mitigation steps specific to credential theft include immediate reporting to the legitimate AllInX security team for takedown coordination. Users who may have interacted with the domain should rotate credentials for AllInX and any other services where identical passwords were reused. Browser-based password managers should be configured to auto-fill only on verified domains to prevent accidental submission to spoofed login pages. Network-level protections should be updated to block the domain and its resolving IP, while security teams should monitor for credential stuffing attempts using harvested logins. The anomalous registration date warrants further investigation into potential registrar abuse or bulk domain registration patterns.