lis-skihs[.]com

This domain, lis-skihs.com, operates as a fake login portal designed to harvest user credentials by impersonating legitimate financial or corporate authentication systems. Analysis of the page structure and metadata reveals cloned login forms, session token fields, and POST endpoints mimicking enterprise single sign-on (SSO) workflows. The infrastructure lacks proper SSL certificate transparency and exhibits rapid redirect chains, which are common in credential harvesting campaigns targeting remote workers and business users. Infrastructure analysis confirms the domain was registered on March 07, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with short-lived phishing domains. It resolves to the IP address 58.64.137.69, which has been linked to multiple credential theft operations in the past 90 days. VirusTotal detection metrics show 9 out of 95 security vendors flagging the domain as malicious, with signatures including 'Phishing.Generic' and 'CredentialTheft:FakeLogin'. The domain appears on one active security blocklist and was proactively taken offline following abuse reports, though residual DNS cache may persist. Users who visited lis-skihs.com or entered credentials on the site should immediately invalidate all active sessions tied to the affected account. Reset passwords using a secure device, enable multi-factor authentication (MFA) via an authenticator app or hardware key, and review recent login activity for unauthorized access. Monitor financial statements and corporate accounts for anomalous transactions, as stolen credentials are often monetized within hours. If session cookies or authentication tokens were exposed, revoke all active tokens and rotate API keys associated with the compromised account. Network administrators should add the domain and IP 58.64.137.69 to perimeter blocklists to prevent internal access.