nineminecore[.]com

This domain is flagged as a credential theft operation designed to harvest login credentials through deceptive login portals. Analysis indicates the site mimics legitimate authentication flows, tricking users into submitting usernames, passwords, and multi-factor authentication codes. The infrastructure is optimized for rapid deployment and evasion, with minimal detection footprint. Infrastructure analysis reveals the domain nineminecore.com was registered on February 05, 2026, through HOSTINGER operations, UAB, and currently resolves to IP address 46.17.175.123. As of the latest scan, VirusTotal reports 0 detections across 95 security engines, suggesting the threat is not yet widely recognized. The domain remains active and uses a Let's Encrypt SSL certificate, providing a false sense of legitimacy to potential victims. No entries on public blocklists have been recorded at this time. Users who visited nineminecore.com should immediately revoke any entered credentials, particularly for financial, email, or corporate accounts. Enable multi-factor authentication on all critical services and monitor for unauthorized access attempts. If credentials were reused across multiple platforms, reset passwords on all associated accounts. Network administrators are advised to block the domain and its resolving IP at perimeter defenses to prevent further exposure.