mwwp-fnjkbvqg-fnjkbvqg-mwwp[.]jindunqst[.]com

This domain is flagged as a generic phishing threat with an elevated risk level, specifically designed for credential harvesting. Analysis indicates the infrastructure is optimized for impersonation attacks, likely targeting users through deceptive login portals or fraudulent account verification pages. The domain currently resolves to a non-operational state, but prior activity suggests it was actively used for malicious purposes. Infrastructure analysis reveals the following technical indicators: the domain mwwp-fnjkbvqg-fnjkbvqg-mwwp.jindunqst.com is detected by 14 out of 95 security vendors on VirusTotal, lacks an SSL certificate, and resolves to the IP address 103.75.15.107, hosted in Hong Kong under AS132839 (POWER LINE DATACENTER). It was registered on September 24, 2024, through Gname.com Pte. Ltd., and is blocked by two security blocklists, including PhishDestroy and PhishingDB. The page title, 域名停靠, translates to "Domain Parking," a common obfuscation tactic for phishing sites. The domain appears on two independent threat intelligence feeds, reinforcing its malicious classification. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (103.75.15.107) at the network perimeter. Organizations should deploy email filtering rules to quarantine messages containing this domain or its subdomains. End-users should be advised to avoid interacting with any links or attachments referencing mwwp-fnjkbvqg-fnjkbvqg-mwwp.jindunqst.com, particularly those soliciting login credentials or personal information. Security teams should monitor for related domains registered through the same registrar (Gname.com Pte. Ltd.) or hosted on the same IP range, as these may indicate additional attack infrastructure. Credential resets should be enforced for any accounts that may have been exposed to this domain prior to its takedown.