m[.]1188xinpujing[.]com

This domain, m.1188xinpujing.com, is flagged as a high-risk generic phishing site designed to impersonate the Grand Lisboa casino brand. The page title, "澳门新葡京娱乐城-中国官方网站-Grand Lisboa," explicitly mimics the official branding of the Macau-based casino operator, suggesting an intent to deceive users into submitting login credentials, financial details, or personal information under false pretenses. No specific drainer kit signatures have been identified in initial scans, but the domain exhibits characteristics consistent with credential harvesting and financial fraud campaigns targeting Chinese-speaking users. Analysis indicates the following technical indicators: VirusTotal detection ratio of 12/95 security vendors, with multiple engines classifying the domain as phishing or malicious. The domain was registered through NameSilo, LLC on June 19, 2026, a future date that may indicate fraudulent or manipulated registration data. It currently resolves to the IP address 19.200.8.105, which has not been widely blocklisted but is associated with other suspicious domains in recent threat intelligence feeds. The SSL certificate is issued by Let's Encrypt, a common tactic among threat actors to lend superficial legitimacy to phishing infrastructure. Google Safe Browsing (GSB) status is not explicitly provided, but the domain remains active and unblocked in many enterprise security stacks. As of the latest assessment, m.1188xinpujing.com remains active and continues to host phishing content. Immediate response actions should include blocking the domain and its associated IP (19.200.8.105) at the network perimeter, as well as deploying endpoint protection rules to prevent user access. Organizations are advised to monitor for credential reuse or unauthorized transactions linked to this campaign, particularly in regions where Grand Lisboa operates. The remaining risk is classified as high due to the domain's active status, brand impersonation, and potential for financial or identity theft. Users who may have interacted with the site should be directed to reset credentials and enable multi-factor authentication on all associated accounts.