pangolin[.]bytebay[.]club

Analysis of pangolin.bytebay.club shows the domain was registered on June 05 2025 through NameCheap, Inc. and is currently taken offline. The authoritative nameservers are gene.ns.cloudflare.com and matt.ns.cloudflare.com, indicating the use of Cloudflare's DNS service. The site resolves to IP address 69.48.203.200, which belongs to AS8560 IONOS SE and is geolocated in the United States. An SSL certificate issued by Let’s Encrypt (R12) is present, confirming that HTTPS was enabled while the site was active.

Infrastructure fingerprints reveal a modern web stack built on Node.js, React, Next.js, Express and bundled with Webpack, a combination frequently observed in credential‑harvesting pages. The page title returned by the server is “Auth - Pangolin”, consistent with the generic authentication prompt used in many e‑commerce phishing campaigns. Threat intelligence indicates the domain appears on two public blocklists and has been actively blocked by PhishDestroy and ScamSniffer, confirming its classification as an e‑commerce phishing operation. VirusTotal scans show five of ninety‑three security vendors flagged the domain, reinforcing the malicious assessment.

Gridinsoft assigns a trust score of 0 out of 100, further indicating a lack of legitimacy. While the site is offline, defenders should continue to block the associated IP range, enforce DNS‑based filtering for the domain, and monitor for rapid re‑registration attempts. Adding the domain to internal deny lists, updating web‑gateway rules, and correlating any login‑related alerts with this indicator will help mitigate potential credential theft. Ongoing observation of the hosting provider IONOS SE for other suspicious assets is recommended.