807xpj[.]com

PhishDestroy identifies 807xpj.com as a credential theft domain designed to trick users into entering sensitive login information. The site presents itself as a navigation portal with the title "快捷导航 - 您的上网入口," likely mimicking a legitimate browser start page to lower user suspicion. Visitors may be prompted to log in to access services, unknowingly handing over their credentials to malicious actors. This domain is part of a broader phishing campaign targeting Chinese-speaking users, as indicated by its appearance in 15 AlienVault OTX threat intelligence pulses.

The technical evidence against 807xpj.com is compelling. VirusTotal data shows 16 out of 95 security vendors flagging this domain as malicious. The domain was registered on March 16, 2022, through GoDaddy.com, LLC, and uses a Let's Encrypt SSL certificate (E7) to appear legitimate. It resolves to IP address 154.205.9.182 and currently appears on 2 security blocklists. Despite being taken offline, its infrastructure may remain active, and similar domains could reappear under different names.

Users who have visited 807xpj.com should immediately change passwords for any accounts accessed while on the site, enable two-factor authentication where available, and monitor financial statements for unauthorized activity. Running a full antivirus scan is also recommended, as some credential theft pages deploy additional malware. PhishDestroy advises treating any unsolicited navigation portals with caution and verifying URLs before entering sensitive information.