76653322[.]com

This domain, 76653322.com, is identified as a credential phishing infrastructure component. Analysis indicates no direct brand impersonation or known drainer kit association, classifying it under generic_phishing. The domain was likely used in broad-scale phishing campaigns aimed at harvesting user credentials, such as email, banking, or social media logins, without targeting a specific organization. Infrastructure analysis reveals the following technical indicators: the domain was registered on August 11, 2018, through a large commercial registrar. It resolves to the IP address 103.143.28.212, hosted in Hong Kong under AS135581. The SSL certificate is issued to Default Company Ltd, a common placeholder for low-effort or automated deployments. At the time of assessment, VirusTotal reports 18 out of 95 security vendors flagging this domain as malicious. The domain appears on one security blocklist and was actively blocked by at least one anti-phishing feed. No Google Safe Browsing (GSB) listing was recorded during its operational period. The domain is currently offline, reducing immediate user exposure. However, residual risk remains due to potential reuse of the infrastructure or registration patterns. Historical DNS records and SSL certificate metadata suggest the domain was part of a larger, disposable phishing operation. Organizations are advised to monitor for re-emergence of this domain or related IPs in logs, particularly in credential submission contexts. Network defenders should block both the domain and its associated IP at perimeter controls and review historical traffic for connections to 76653322.com or 103.143.28.212 to identify compromised accounts or lateral movement attempts.