ss136[.]us[.]cc

Analysis of ss136.us.cc as of July 24, 2026, confirms active phishing infrastructure targeting user credentials. The domain was registered on April 7, 2006, through Gname.com Pte. Ltd., an uncommon registrar for phishing activity but not unprecedented. It currently resolves to IP address 128.241.229.113, with nameserver delegation split between a.rsp-dns.com, b.rsp-dns.com, ns1.domainnamens.com, and ns2.domainnamens.com—infrastructure patterns consistent with bulletproof or low-reputation DNS providers frequently reused across multiple phishing campaigns.

One security blocklist, PhishDestroy, has already flagged the domain, and six of ninety-one security vendors on VirusTotal classify it as malicious, indicating cross-industry detection without widespread consensus. No specific brand impersonation or phishing kit has been confirmed through available metadata; the exact content and target remain unanalysed. However, the domain's continued resolution and active blocklist presence suggest ongoing operational use.

Defenders should treat ss136.us.cc as high-risk and prioritise blocking at DNS, proxy, and endpoint layers. Network monitoring for connections to 128.241.229.113 or the listed nameservers may reveal additional compromised endpoints or related phishing domains sharing the same infrastructure. No SSL certificate or HTTP status data was provided; further enrichment is recommended if the domain remains active beyond initial triage.