home-zlksz6[.]com

This domain, home-zlksz6.com, is identified as a brand impersonation phishing site targeting Royal Madrid football club and Kering Sports (officially branded as 开云体育). The page title, "球俱乐部官方区域合作伙伴    开云体育官网-皇家马德里足," explicitly mimics the club’s official regional partner portal, suggesting an intent to deceive fans, sponsors, or affiliates into disclosing sensitive information or engaging with fraudulent content. Analysis indicates the site was operational until recently but has since been taken offline. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on February 25, 2026, an unusually forward-dated creation that may indicate an attempt to evade immediate detection. It resolved to the IP address 172.65.242.166 and was flagged by 18 of 95 security vendors on VirusTotal, reflecting a consensus among detection engines regarding its malicious nature. The domain appears on one security blocklist, and passive DNS records confirm the use of Nginx as the web server, alongside front-end libraries such as jQuery and jQuery Migrate. The presence of HTTP Strict Transport Security (HSTS) headers suggests an effort to lend legitimacy to the site, though this does not mitigate the underlying threat. Current status indicates the domain is offline, though residual risk remains for users who may have interacted with it prior to takedown. Organizations and individuals are advised to monitor for unauthorized access attempts linked to this infrastructure, particularly those involving credentials or financial transactions associated with sports partnerships or fan engagement. Network defenders should block the domain and IP address at perimeter controls and review logs for connections to 172.65.242.166. Users who visited the site should reset passwords for any accounts accessed during the exposure window and enable multi-factor authentication where available. Security teams are encouraged to correlate this activity with other impersonation campaigns targeting sports brands, as this may represent a broader trend in credential theft or fraud.