mi5vt2is[.]top

This domain, mi5vt2is.top, is identified as a credential phishing site designed to harvest user login credentials through deceptive input forms. The page title 'wellcome' suggests an attempt to impersonate a legitimate welcome or login portal, though no specific brand or drainer kit association has been confirmed. The site employs basic obfuscation techniques to evade detection, but analysis indicates a lack of advanced infrastructure typically seen in more sophisticated phishing campaigns. Infrastructure analysis reveals the domain was registered on April 03, 2025, through Gname.com Pte. Ltd. It resolves to the IP address 47.253.178.175, hosted on Alibaba (US) Technology Co., Ltd. infrastructure (AS45102). At the time of assessment, the domain was flagged by 19 out of 95 security vendors on VirusTotal, with a single entry on known security blocklists. The SSL certificate status remains unknown, and the domain does not appear on Google Safe Browsing (GSB) at this time. The combination of a recently registered domain, low blocklist presence, and minimal vendor detections suggests a short-lived or opportunistic phishing operation. The domain is currently offline, likely taken down following detection by security mechanisms such as PhishDestroy. While the immediate threat has been mitigated, residual risk remains for users who may have interacted with the site prior to takedown. Organizations are advised to monitor for credential reuse attempts and implement multi-factor authentication (MFA) to mitigate potential account compromise. Network administrators should block the domain and associated IP (47.253.178.175) at the perimeter to prevent further exposure. No further malicious activity has been observed from this infrastructure at the time of reporting.