1775ee[.]com

This domain, 1775ee.com, is identified as a credential theft infrastructure designed to harvest user login credentials through deceptive login portals. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, though its long-standing presence since 2017 suggests recurring malicious use. The domain’s primary function appears to be the collection of sensitive authentication details, likely through fake login pages mimicking legitimate services or corporate portals.

Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 103.143.28.212, hosted on AS135551 in Hong Kong, and was registered via GoDaddy.com, LLC on October 10, 2017. It is flagged by 19 out of 95 security vendors on VirusTotal, with two independent blocklists (PhishDestroy and PhishingDB) listing it as malicious. The SSL certificate, issued to Default Company Ltd, further indicates a lack of legitimate ownership, and the domain consistently triggers privacy errors in browsers, a common red flag for phishing activity.

As of the latest assessment, 1775ee.com has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, the domain’s historical persistence and prior use in credential theft campaigns pose a residual risk. Users who may have interacted with the domain are advised to reset credentials for any accounts accessed during the period of exposure. Organizations should monitor for related indicators, including the IP address and SSL certificate details, to detect potential lateral movement or follow-up attacks.