elysiumutkwscnmdohi23gkcyp3edrf4iio3sngc5tvcgyfp4nqqmwad[.]top

This domain, elysiumutkwscnmdohi23gkcyp3edrf4iio3sngc5tvcgyfp4nqqmwad.top, is flagged as a generic phishing threat specializing in credential harvesting. Analysis indicates no direct association with known brand impersonation or cryptocurrency drainer kits, suggesting a broad-spectrum phishing campaign targeting login credentials across multiple platforms. The infrastructure appears designed for rapid deployment and evasion, leveraging cloud-based hosting to obscure origin and maintain persistence. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.67.164.80, a shared hosting node commonly used for malicious activities. It was registered on June 12, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently exploited for short-lived phishing domains. VirusTotal detection metrics show 6 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), providing a veneer of legitimacy to unsuspecting users. Google Safe Browsing currently lists the domain as active and unblocked, indicating ongoing risk exposure. Current status remains active, with no evidence of takedown or mitigation efforts. The domain continues to resolve and serve content, posing a high risk to users who may encounter it through phishing emails, malicious advertisements, or compromised third-party sites. Response actions should include immediate blocklisting at the network and endpoint levels, as well as monitoring for related domains registered through the same registrar or resolving to the same IP range. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication, and report suspicious URLs to security teams for further analysis. The remaining risk is elevated due to the domain's persistence, low detection rate, and use of trusted SSL infrastructure.