login-xingkongzh[.]com[.]cn

This domain is flagged as an elevated-risk credential phishing site targeting users of online sports betting platforms. Analysis indicates the infrastructure is designed to mimic legitimate gambling or gaming services, as evidenced by the page title '星空体育官方入口-星空体育注册领奖及安全登录,' which translates to a fraudulent sports betting or prize registration portal. The specific threat involves tricking users into submitting login credentials, personal information, or financial details under the pretense of account access, prize claims, or secure registration. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on May 24, 2026, through 山西凯利晶信网络科技有限公司, a registrar frequently associated with suspicious or malicious domains. It resolves to the IP address 201.5.126.162, which has been linked to prior phishing campaigns. The SSL certificate is issued by Let's Encrypt, a common choice for threat actors due to its free and automated issuance process. Security vendor detections on VirusTotal show 17 out of 95 engines flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and has been included in a threat intelligence pulse on AlienVault OTX, further corroborating its malicious nature. The domain is currently offline, likely due to takedown efforts or operational changes by the threat actors. To mitigate the risk posed by this credential phishing domain, organizations and users should implement the following measures. First, block the domain and its associated IP address (201.5.126.162) at the network level using firewalls or DNS filtering solutions. Second, deploy endpoint protection that detects and blocks phishing pages based on known indicators of compromise, such as the domain name, SSL certificate issuer, and page title patterns. Third, conduct user awareness training to educate individuals on recognizing phishing attempts, particularly those impersonating gaming, betting, or prize-claiming platforms. Fourth, monitor for any attempts to access this domain or related infrastructure within corporate or personal networks, as such activity may indicate compromised credentials or ongoing phishing attempts. Finally, report the domain to relevant cybersecurity organizations or threat intelligence platforms to contribute to broader defense efforts against similar threats.