p80n[.]xyz

This domain, p80n.xyz, is identified as a credential theft operation targeting Chinese-speaking users through deceptive infrastructure. Analysis reveals the site masquerades as a CDN error page (站点未配置SSL证书 - CDN 3.0), a common tactic to trick users into entering sensitive information under the guise of technical issues. No brand impersonation or crypto drainer kit signatures were detected, but the lack of SSL and localized error messaging strongly suggest credential harvesting for unauthorized account access or identity fraud. The domain exhibits no legitimate business indicators, reinforcing its fraudulent nature. Infrastructure analysis provides concrete technical indicators of malicious activity. The domain resolves to IP 43.242.129.10, hosted on AS133199 (SonderCloud Limited) in Hong Kong, a jurisdiction frequently exploited for bulletproof hosting. Registered through Gname.com Pte. Ltd. on August 01, 2025, the domain remains in its first operational month, a typical lifecycle phase for phishing campaigns. Security vendors flagged the domain on VirusTotal with 14/95 detections, while it appears on two blocklists (PhishDestroy, PhishingDB). The absence of SSL certification further undermines trust, as modern browsers flag such sites as insecure, yet threat actors exploit this to create urgency for victims to bypass warnings. Current status shows the domain has been taken offline, likely due to enforcement actions or hosting suspension. However, residual risk persists as the infrastructure may resurface under a new domain or IP. Users who interacted with the site should immediately reset credentials for any accounts accessed during the exposure window, particularly if multi-factor authentication was not enabled. Organizations should monitor for related indicators, including the registrar (Gname.com) and hosting provider (SonderCloud), as these entities are recurrently associated with malicious domains. Proactive blocking of the IP (43.242.129.10) and domain is recommended to prevent future exposure.