pyjja[.]top

This domain, pyjja.top, is currently under investigation as an active credential theft operation targeting Chinese-speaking users. Analysis of the page title "首页" (translated as "Homepage") and linguistic patterns suggests an attempt to impersonate local services or platforms to harvest login credentials, financial details, or personal information. The site remains operational as of the latest verification, with no prior user reports or automated detections. Infrastructure analysis reveals the domain was registered on June 30, 2026, through NameMart Pte. Ltd., an uncommon registrar for legitimate services. It resolves to the IP address 104.20.28.212, a Cloudflare-associated endpoint often leveraged to obfuscate origin servers. Despite its active status, the domain has not been flagged by any of the 95 security vendors on VirusTotal, indicating either a new campaign or evasive tactics. The SSL certificate is issued by SSL Corporation, a provider frequently used by both legitimate and malicious sites. No blocklist entries or trust score deviations were observed at the time of analysis. The domain remains accessible, and no takedown actions have been recorded. Organizations and users are advised to block traffic to 104.20.28.212 and pyjja.top at the network level. Endpoints should be monitored for connections to this IP or domain, particularly those involving form submissions or authentication requests. Given the zero-detection status, manual inspection of web traffic logs is recommended to identify potential compromise. Users should verify the legitimacy of any site requesting credentials, especially those with non-Latin characters in the page title or URL.