admin[.]68698[.]vip

The domain admin.68698.vip was registered through Dynadot LLC on September 18, 2025 and presently resolves to the IP address 38.46.13.38, which is allocated to AS9294 GNET INC. in Hong Kong. The domain is served by the authoritative name servers ns1.dnsip.com and ns2.dnsip.com and does not present an SSL/TLS certificate, indicating that any traffic to the site would be unencrypted. Independent threat‑intel feeds have placed the domain on a single security blocklist and it is explicitly blocked by the PhishDestroy service.

Google Safe Browsing classifies the domain under the social‑engineering category, reinforcing the suspicion of credential‑harvesting intent. VirusTotal scans show that 14 of 93 security vendors have flagged the domain, providing a modest consensus of malicious disposition. Additional reputation data from Gridinsoft assigns the domain a trust score of 0 out of 100, the lowest possible rating. As of the report date (July 23 2026) the domain is reported as taken offline, which may be a temporary takedown or a deliberate shutdown by the operators.

The available evidence confirms the presence of a phishing infrastructure but does not reveal the specific target brand, page title, or malicious payload details, leaving the exact attack vector uncertain. Defenders should continue to block the domain at perimeter and DNS filtering layers, monitor the associated IP 38.46.13.38 for any resurgence of activity, and consider adding the domain to internal blocklists. Given the lack of TLS and the low trust score, any residual traffic should be treated as high‑confidence malicious, and incident response teams should investigate any recent authentication attempts that might have involved this infrastructure.