15005[.]vip

This domain, 15005.vip, is currently flagged as an active credential phishing site. Analysis indicates the domain was registered on March 14, 2022, through Wild West Domains, Inc., and resolves to the IP address 156.234.227.173. The page title, displayed as '欢迎' (translated as 'Welcome'), suggests a generic landing page, though the exact content and targeted brand or service remain unconfirmed due to limited forensic analysis. The domain is hosted on infrastructure utilizing Nginx and OpenResty, with jQuery detected as a frontend technology, which is consistent with many phishing kits designed for rapid deployment and obfuscation. Infrastructure analysis reveals the domain is associated with a Let's Encrypt SSL certificate, a common feature in both legitimate and malicious sites due to its free and automated issuance. However, the domain appears in 50 threat intelligence pulses on AlienVault OTX, and 17 out of 95 security vendors on VirusTotal have flagged it as malicious. Additionally, it is blocked by three security blocklists, including PhishDestroy, PhishingDB, and BLP-Malware, further corroborating its classification as a high-risk phishing resource. Gridinsoft and Scamadviser both assign trust scores of 1 or lower out of 100, reinforcing the domain's suspicious nature. While the specific phishing kit or targeted brand has not been identified, the combination of technical indicators and threat intelligence reporting strongly suggests this domain is part of a broader phishing campaign. Defenders should treat this domain as hostile and prioritize blocking it at the network and endpoint levels. Given its active status as of July 12, 2026, organizations are advised to monitor for connections to 156.234.227.173 and the domain itself, as well as to review logs for any prior interactions. No additional brand-specific indicators are available at this time, so generic phishing detection rules should be applied.