1665ddd[.]com

This domain, 1665ddd.com, is identified as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates no direct association with a specific brand or drainer kit, suggesting a generic phishing campaign designed to capture sensitive authentication details. The page title, matching the domain name, reinforces the lack of legitimate branding, a common tactic to avoid immediate suspicion while harvesting credentials. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 103.143.28.212, hosted in Hong Kong under AS135581 (ONL-HK). It was registered on August 03, 2018, through GoDaddy.com, LLC, and uses a default SSL certificate issued to 'Default Company Ltd.' VirusTotal detections show 18 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The domain has not been listed in Google Safe Browsing databases, indicating potential gaps in automated detection coverage. As of the latest assessment, 1665ddd.com has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, the domain remains registered, posing a residual risk of reactivation under the same or altered infrastructure. Organizations are advised to monitor for DNS resolution changes, SSL certificate updates, or renewed hosting activity. Network-level blocking of the associated IP (103.143.28.212) and domain is recommended to prevent potential re-emergence. Users should verify login portals through official channels and report any suspicious activity involving this domain to their security teams.