tr[.]ngsbahis-hemenboss[.]vip

This domain is flagged as an active credential theft phishing site targeting users through deceptive login interfaces. Analysis indicates an elevated risk level due to confirmed malicious infrastructure and detection by multiple security mechanisms. Users encountering this domain should assume any interaction may lead to unauthorized account access or data exfiltration. Infrastructure analysis reveals the following technical indicators: the domain tr.ngsbahis-hemenboss.vip was registered on March 13, 2026, through NiceNIC International Group Co., Limited, an uncommon registrar for legitimate services. It resolves to IP address 172.67.159.148, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (serial E8), a common choice for both legitimate and malicious sites. VirusTotal detection shows 17 out of 95 security vendors flagging the domain as malicious, while PhishDestroy has explicitly blocked it. The page title, 'Suspected phishing site | Cloudflare,' further confirms its compromised status, as legitimate services do not self-identify as suspicious. Mitigation steps for credential theft threats include immediate cessation of interaction with the domain. Users who may have entered credentials should rotate passwords for all associated accounts, particularly financial or email services, and enable multi-factor authentication where available. Network administrators should block the domain and IP address at the perimeter level to prevent internal access. Security teams should monitor for indicators of compromise, including the domain, IP, and SSL certificate fingerprint, in logs and endpoint detection systems. Given the domain's recent registration and active blocklisting, continued monitoring for related infrastructure is recommended.