021wanbo[.]com

021wanbo.com was registered through Dynadot LLC on March 03 2026. The domain resolves to 20.255.104.129, an address announced by AS8075 Microsoft Corporation and geolocated in Hong Kong. Authoritative name servers are anahi.ns.cloudflare.com and harlan.ns.cloudflare.com, indicating the use of Cloudflare DNS. The site presents a valid Let’s Encrypt R12 certificate, which does not provide any indication of benign intent.

The landing page returns an HTTP 301 redirect and displays the title “万博体育|五大联赛官方合作伙伴”, a phrase commonly associated with sports betting promotions. Automated analysis shows a technology stack of Bootstrap, Swiper, Moment.js and jQuery, which are typical of commodity web templates used in credential‑harvesting campaigns. Gridinsoft assigns a trust score of 0 out of 100, and only one security blocklist currently lists the domain. VirusTotal reports a single positive detection out of 95 scanners, and the domain is flagged by PhishDestroy, reinforcing a high‑risk classification.

While the infrastructure signals a phishing infrastructure, the public evidence does not reveal the exact phishing kit, target brand, or any harvested credentials. The content behind the redirect has not been captured, leaving uncertainty about the specific lures or victim interaction flow. No additional sub‑domains or related infrastructure have been correlated at this time, and the low detection count may reflect limited exposure rather than lack of malicious intent.

Defenders should treat 021wanbo.com as hostile. Immediate actions include adding the domain to DNS and web‑proxy blocklists, monitoring for outbound connections to 20.255.104.129, and instrumenting network sensors to detect any HTTP requests to the site. Because the domain uses Cloudflare, sink‑holing the IP may not be feasible, so threat‑intel feeds should be updated with the domain, its nameservers and IP address. Continuous re‑assessment is advised in case additional detections appear.