occuxi[.]com

Analysis of the domain occuxi.com indicates it is actively involved in phishing operations targeting user credentials under the guise of account verification. The domain was registered on April 30, 2024, through HOSTINGER operations, UAB, and remains operational as of July 27, 2026. Infrastructure analysis reveals it resolves to the IP address 82.197.83.155, with nameservers ns1.dns-parking.com and ns2.dns-parking.com, a configuration commonly associated with low-cost or disposable hosting environments often exploited for malicious campaigns. The domain is flagged by four out of ninety-one security vendors on VirusTotal, a detection rate consistent with emerging or evasive phishing infrastructure.

It also appears on one security blocklist, further corroborating its malicious classification. The specific brand or service being impersonated has not been confirmed through available evidence, though the threat type is classified as generic phishing, likely designed to harvest login credentials or personal information. No details regarding the page title, SSL certificate, or underlying phishing kit have been provided, limiting granular assessment of its operational mechanics. Defenders should treat occuxi.com as a high-risk domain and prioritize blocking it at the DNS, proxy, or endpoint level.

Network monitoring for connections to 82.197.83.155 or the associated nameservers may help identify compromised systems. Given the domain's recent creation and active status, organizations should also review logs for any prior interactions with this infrastructure, particularly in contexts involving unsolicited verification requests or credential submission prompts. Additional scrutiny of domains registered through the same registrar or resolving to the same IP range may uncover related threats.