nighixw[.]vip

Analysis of the domain nighixw.vip indicates it is actively hosting a phishing site targeting users of a dating or adult-content platform, as suggested by the page title 'Nachtliebe.' The domain was registered on September 8, 2025, through Gname.com Pte. Ltd., and currently resolves to the IP address 35.240.219.19. Infrastructure analysis reveals the use of Vue.js and Nginx, alongside HSTS implementation, which may be employed to lend an appearance of legitimacy or to evade certain security controls. The domain is flagged on two security blocklists and appears in 23 threat intelligence pulses on AlienVault OTX, indicating prior detection by security researchers. Three of 95 security vendors on VirusTotal have classified this domain as malicious. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. The domain's trust score is 0/100, further supporting its classification as high-risk. At present, the exact content and mechanics of the phishing scheme remain unconfirmed, as the site has not been directly analyzed. However, the combination of a suggestive page title, recent registration, and presence on multiple threat intelligence platforms suggests an active campaign. Defenders should treat this domain as hostile and block it at the DNS or proxy level. Monitoring for connections to 35.240.219.19 or related infrastructure may help identify compromised endpoints. Additional investigation into the site's content and payloads is recommended to determine the precise nature of the threat.