cf995[.]com

This domain, cf995.com, poses as the official E世博 (esball) gambling platform targeting Chinese-speaking users. Analysis indicates it is a generic phishing site designed to harvest login credentials, financial details, or install unauthorized gambling software. The site uses localized branding (E世博·esball [中国]官方网站) to appear legitimate, but infrastructure and detection patterns confirm malicious intent. Users who enter credentials or download files may expose personal data, payment information, or device control to threat actors. Infrastructure analysis reveals multiple high-confidence indicators. The domain was registered on May 20, 2026, through TuringSign Inc. d/b/a Cosmotown, a registrar frequently associated with fraudulent sites. It resolves to IP 156.227.96.76 and uses a Let’s Encrypt SSL certificate, a common tactic to mimic security. VirusTotal shows 20 out of 95 security vendors flagging cf995.com, including detections from PhishDestroy and OISD blocklists. Technologies detected include Bootstrap, Nginx, HSTS, and Baidu Analytics, further suggesting an attempt to replicate a professional gambling portal. If you visited cf995.com, take immediate action. Disconnect the device from the network to prevent potential data exfiltration. Run a full antivirus scan using updated definitions to detect any installed malware. Reset passwords for all accounts accessed on the device, prioritizing financial and email services. Monitor bank statements and credit reports for unauthorized transactions. If credentials were entered, assume they are compromised and enable multi-factor authentication where possible. Report the domain to local cybersecurity authorities or platforms like Google Safe Browsing to prevent further victimization.