9500yh[.]com

This domain, 9500yh.com, is flagged as an active brand-impersonation phishing site. Registered on May 19, 2026, through NameSilo, LLC, the domain presents itself as the official website for 银河娱乐 (Galaxy Entertainment) in China, as indicated by its page title, 银河娱乐 (中国)官方网站. The site is currently operational, resolving to IP address 168.76.223.163, hosted under AS137951 (ASLINE LIMITED) in Hong Kong. Infrastructure analysis reveals the use of Nginx as the web server, with Bootstrap for frontend design and Baidu Analytics for tracking. The domain enforces HTTPS via a Let's Encrypt certificate (R13) and implements HSTS, which may lend an appearance of legitimacy to unsuspecting users. The domain has been detected on one security blocklist and is flagged by 12 of 91 security vendors on VirusTotal, indicating broad recognition as malicious. AlienVault OTX lists the domain in two threat intelligence pulses, further corroborating its association with phishing activity. A 301 HTTP redirect is present, though the destination remains unconfirmed. Nameservers (ns1.domainnamedns.com through ns4.domainnamedns.com) are consistent with low-cost, high-volume hosting patterns often exploited for phishing campaigns. Defenders should treat this domain as high-risk. Block access at the network level, particularly for users in regions where 银河娱乐 operates. Monitor for credential harvesting or financial fraud attempts originating from this infrastructure. Given the use of Baidu Analytics, defenders may also investigate associated tracking IDs for additional compromised domains. The domain's recent registration and active status suggest it may remain in use for the foreseeable future, warranting continued vigilance.