rentacad[.]com

This domain is flagged for elevated risk due to generic phishing activity targeting users of online gambling and sports betting platforms. Analysis indicates the site mimics legitimate services under the guise of 九游会体育-J9品牌官网, a known tactic to harvest credentials, payment details, or personal data from unsuspecting victims. Infrastructure analysis reveals the domain was registered on December 15, 2024, through GoDaddy.com, LLC, and resolves to the IP address 154.89.186.112, hosted in Hong Kong under AS400619 (AROSSCLOUD INC.). The SSL certificate is issued by Let's Encrypt (R12), a common choice for malicious actors due to its low-cost and automated issuance. VirusTotal detection rates show 18 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and was actively blocked by PhishDestroy prior to being taken offline. The page title, written in Chinese, further suggests targeting of Mandarin-speaking users, a demographic frequently exploited in phishing campaigns. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (154.89.186.112) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to newly registered domains (NRDs) with gambling-related keywords, particularly those registered within the last 30 days. Users who may have interacted with the domain should be instructed to reset credentials for any accounts accessed during the exposure window, with priority given to financial or email accounts. Monitoring for unusual login attempts or transactions linked to the affected user base is recommended for at least 90 days post-exposure. Network logs should be reviewed for connections to 154.89.186.112 or domains with similar naming patterns (e.g., typosquatting variations of gambling brands).