xn--c1a3a[.]xn--h1aaahdlb4aki4h[.]xn--p1ai

PhishDestroy’s seed cf462f has flagged xn--c1a3a.xn--h1aaahdlb4aki4h.xn--p1ai as a generic phishing domain currently active in the wild. The domain mimics legitimate services to harvest credentials and sensitive data from unsuspecting users. No specific brand or drainer kit has been positively identified at this stage, but the infrastructure is consistent with credential harvesting campaigns. This domain resolves to IP 45.141.76.149 and is secured with a Let’s Encrypt SSL certificate. VirusTotal currently shows 0 detections out of 95 scanners, indicating evasion of automated detection mechanisms. The domain is registered under the .xn--p1ai TLD, which is associated with Russian domains, though the exact registrar and creation date remain unverified in public records. Google Safe Browsing (GSB) has not yet flagged the domain, and no known blocklist entries have been recorded. The domain remains active and under investigation, with no definitive attribution or broader campaign mapping. Users are advised to avoid interaction and report any observed activity. While the immediate risk is classified as under investigation, the lack of detections and active resolution pose a latent threat. Organizations and individuals should monitor for related indicators and consider proactive blocking of the IP and domain.