022xin888[.]com

This domain, 022xin888.com, is currently flagged as an active credential phishing endpoint targeting Chinese-speaking users. Analysis indicates the domain was registered on March 3, 2026, through Dynadot LLC, with an SSL certificate issued by Let's Encrypt (R13). The page title '验证' (verification) suggests a fraudulent login or authentication portal, a common tactic in credential harvesting schemes. The domain resolves to IP address 20.255.200.238, hosted under AS8075 (Microsoft Corporation) in Hong Kong, which may leverage cloud infrastructure to evade traditional IP-based blocking. Infrastructure review reveals the domain employs a 301 HTTP redirect, potentially funneling victims to a secondary malicious endpoint not yet identified. Nameservers are hosted under dnsever.com, a provider occasionally associated with low-reputation domains. Detection coverage remains limited, with only 1 of 95 security vendors on VirusTotal flagging the domain as malicious, and a single blocklist (PhishDestroy) currently enforcing restrictions. The Gridinsoft trust score of 0/100 further corroborates its high-risk classification. Technical indicators include the use of jQuery UI and jQuery CDN, which are legitimate libraries but frequently exploited in phishing kits to mimic interactive login forms. The domain's recent creation date and minimal detection footprint suggest it may be part of a larger, rotating campaign designed to avoid automated detection systems. Defenders should prioritize blocking the domain at DNS and proxy levels, as well as monitoring for connections to the associated IP (20.255.200.238) and nameserver infrastructure. Given the limited vendor coverage, manual verification of user-reported access attempts is recommended to identify potential breaches.