dsycgyl[.]com

This domain, dsycgyl.com, is flagged as a generic phishing site designed to mimic legitimate login portals. The page title '欢迎光临' (translated as 'Welcome') suggests targeting users of Chinese-language services, though no specific brand impersonation or crypto drainer kit has been confirmed. The site appears to function as a credential harvester, capturing user inputs through a fraudulent interface. No direct association with known phishing frameworks or malware families has been established at this time, though the infrastructure aligns with common phishing deployment patterns. Analysis indicates the domain was registered on July 23, 2025, through eName Technology Co., Ltd., a registrar frequently utilized in phishing campaigns. It resolves to the IP address 104.21.79.6, a Cloudflare-hosted endpoint, which may obscure the true origin of the malicious activity. VirusTotal reports 0 detections out of 95 security engines, indicating the campaign remains undetected by most vendors. The domain appears on a single security blocklist, and Gridinsoft assigns it a trust score of 0/100. Technologies detected include HSTS, Cloudflare Browser Insights, and HTTP/3, suggesting the use of modern web protocols to enhance legitimacy and evade detection. As of the latest assessment, dsycgyl.com has been taken offline, likely due to intervention by security providers or hosting infrastructure. However, the domain remains registered, and the underlying infrastructure could be repurposed for future phishing activity. Users who may have interacted with the site are advised to reset credentials for any accounts accessed during the exposure window and monitor for unauthorized activity. Organizations should update blocklists to include the domain and associated IP, while security teams should investigate potential lateral movement or follow-up attacks stemming from compromised credentials. The low detection rate underscores the need for proactive monitoring of newly registered domains with similar characteristics.