76650022[.]com

This domain, 76650022.com, is flagged as a credential harvesting phishing site targeting unsuspecting users through deceptive login interfaces. Analysis indicates no direct association with a specific brand or drainer kit, though the use of a generic 'Loading' page title suggests an attempt to mimic legitimate authentication portals or delay detection. The infrastructure lacks overt branding, increasing the likelihood of broad, opportunistic phishing campaigns rather than targeted attacks against a single entity. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on February 21, 2026, through GoDaddy.com, LLC, a common registrar for both legitimate and fraudulent domains. It resolves to the IP address 103.143.28.212, hosted in Hong Kong under autonomous system AS135581. The SSL certificate, issued to 'Default Company Ltd,' is a default configuration often seen in low-effort phishing setups. VirusTotal reports 20 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by PhishDestroy. Google Safe Browsing (GSB) status is not explicitly provided, but the detection rate and blocklist presence strongly suggest inclusion. The domain is currently offline, likely due to takedown actions or infrastructure abandonment by the threat actor. While this mitigates immediate risk, residual threats persist, including potential reuse of the domain or IP for future campaigns. Users who may have interacted with the site should assume credential exposure and initiate password resets for any accounts accessed during the period of activity. Organizations are advised to monitor network logs for connections to 103.143.28.212 and implement blocklist updates to prevent future access. The elevated risk level remains until the domain is permanently sinkholed or revoked, as threat actors frequently repurpose dormant infrastructure.