chickenroadnz[.]run

Analysis of the domain chickenroadnz.run indicates it is an active credential phishing infrastructure operating since February 21, 2026. The domain resolves to IP address 89.110.79.20, hosted on AS216071 (SERVERS TECH FZCO) in the Netherlands. Infrastructure analysis reveals the use of custom nameservers (ns1.vdsina.com, ns2.vdsina.com) and a dedicated MX record (mx.chickenroadnz.run with priority 10), suggesting email-based phishing capabilities. The page title 'Chicken Road New Zealand – Easy to Play, Hard to Quit' implies a localized lure, though the exact content and targeted brand remain unverified as the site has not been directly analyzed. The domain was registered through NiceNIC International Group Co., Limited, a registrar frequently observed in phishing campaigns. Detected technologies include Nginx, Slick, jQuery Migrate, and jQuery, which are common in both legitimate and malicious sites but provide no definitive classification. The SSL certificate is issued by Let's Encrypt (R12), a neutral indicator. As of July 12, 2026, the domain remains active, returning an HTTP 200 status, and is blocked by at least one security vendor (PhishDestroy). Two of 95 security vendors on VirusTotal flag the domain, though this detection rate is not conclusive evidence of maliciousness. Defenders should treat this domain as high-risk due to its recent registration, dedicated infrastructure, and confirmed phishing classification. Network-level blocking or monitoring of connections to 89.110.79.20 is recommended. Further analysis of the site's content and email templates would clarify the specific credential harvesting methods and targeted entities. No evidence suggests this domain is part of a broader campaign, but its infrastructure aligns with credential phishing operations observed in 2026.