gitlab[.]connexion[.]com[.]my

The domain gitlab.connexion.com.my is currently active and hosts a page whose title reads "Anmelden · GitLab", indicating an attempt to masquerade as the GitLab login portal. The site resolves to the IPv4 address 121.123.92.124, which is allocated to an ASN owned by Binariang Berhad in Malaysia. The hosting server runs Ubuntu behind an Nginx web server, and the TLS certificate is issued by Let’s Encrypt (R12), a common choice for low‑cost deployments. The domain was registered on 12 September 2007 through IP ServerOne Solutions Sdn Bhd and uses the authoritative nameservers ns1.connexion.com.my and ns2.connexion.com.my.

Three of ninety‑three VirusTotal scanners have flagged the domain as malicious, and it appears on at least one external blocklist. The Gridinsoft trust score is 0 out of 100, and PhishDestroy has already added the host to its block list. An HTTP request returns a 302 redirect, a pattern often used to forward victims to a credential‑harvesting endpoint. No additional content, screenshots, or login‑form details have been publicly disclosed, so the exact phishing kit or credential capture mechanism remains unknown.

Defenders should block the domain and its resolving IP at perimeter and DNS filtering layers, add the host to internal threat‑intelligence feeds, and monitor for outbound connections to the IP. Users of GitLab should be reminded that legitimate GitLab services are served from gitlab.com and that any request to a sub‑domain of connexion.com.my is unauthorized. Incident response teams should collect any network logs that reference the domain and consider investigating compromised credentials if they match the timeframe of the observed redirects. Given the low trust score, blocklist presence, and 302 redirect behavior, the risk rating is high and the infrastructure appears deliberately low‑profile while leveraging a legitimate SSL certificate to increase perceived legitimacy.