gkbci29u[.]dongjiakg[.]com

This domain, gkbci29u.dongjiakg.com, is flagged as a generic phishing site targeting users through the impersonation of a corporate entity. The page title, "57365z线路检测中心(中国)股份有限公司," suggests an attempt to mimic a legitimate Chinese infrastructure or telecommunications company. No specific drainer kit or known phishing framework has been conclusively linked to this domain at this time, though the use of a non-standard subdomain and generic hosting infrastructure aligns with common phishing tactics. The domain does not appear to target a globally recognized brand but instead relies on localized deception to exploit trust in regional corporate entities. Analysis indicates the following technical indicators: the domain was registered on August 26, 2024, through Gname.com Pte. Ltd., a registrar frequently associated with low-reputation domains. It resolves to the IP address 104.206.250.27, which has been observed in prior phishing campaigns. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, while it appears on one additional security blocklist. No SSL certificate was detected, further reducing the domain's legitimacy. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect a lag in detection rather than an absence of threat. The domain is currently offline, likely due to takedown actions or abandonment by the threat actor. However, the infrastructure remains a residual risk, as the IP address and registrar may still be leveraged for future phishing operations. Users who accessed the domain prior to its takedown should assume potential exposure to credential harvesting or malware delivery. Organizations are advised to monitor for related indicators of compromise, including the IP address 104.206.250.27 and domains registered through Gname.com Pte. Ltd. during the same timeframe. Proactive blocking of the domain and IP at the network level is recommended to mitigate any lingering threat.