admin[.]535787[.]top

This domain, admin.535787.top, is identified as a high-risk credential harvesting phishing site designed to deceive users into submitting sensitive login information. Analysis indicates the infrastructure was specifically established to mimic legitimate authentication portals, likely targeting corporate or financial service users. The absence of an SSL certificate further increases the risk of interception during data transmission, exposing submitted credentials to unauthorized third parties. Infrastructure analysis reveals the domain was registered on June 09, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with short-lived malicious domains. It resolves to the IP address 192.238.136.8, hosted under AS138995 (Antbox Networks Limited) in Hong Kong, a network segment with a documented history of hosting phishing and malware distribution sites. Detection metrics confirm the domain is flagged by 18 out of 95 security vendors on VirusTotal, while it appears on one known security blocklist. Google Safe Browsing has also classified this domain as phishing, reinforcing its malicious classification. Users who visited admin.535787.top or entered credentials on this site should immediately revoke any submitted passwords, particularly for email, banking, or enterprise accounts. It is recommended to enable multi-factor authentication where available and monitor associated accounts for unauthorized activity. System administrators should update network defenses to block the domain and its resolving IP address, 192.238.136.8, across perimeter security controls. Given the domain’s current offline status, further monitoring of related infrastructure is advised to detect potential re-emergence under alternate naming conventions.