email-verify[.]online

email-verify.online is currently active and classified as a high‑risk credential‑phishing site. The domain was registered on May 23 2026 through Alibaba Cloud Computing Ltd. d/b/a HiChina and first appeared in a single AlienVault OTX pulse. The site presents a Chinese language login page titled “用户登录 - 邮箱验证平台”, indicating an attempt to harvest email credentials. The domain resolves to IP 151.245.90.111, an address hosted in Hong Kong by OrangeVPS LLC. The TLS certificate is issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025, confirming the use of a valid, but likely purchased, SSL certificate to lend legitimacy. Name resolution is provided by dns3.hichina.com and dns4.hichina.com, both operated by the registrar. Web requests receive an HTTP 302 redirect, a common technique to obscure the final landing page while preserving the initial URL for credential capture. The MX record points to server.email-verify.online, suggesting the domain may also be used for inbound mail collection. Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 / 100, and the domain is listed on three security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows that 3 of 95 scanned security vendors flagged the domain, reinforcing the malicious classification. Defenders should add email-verify.online to URL filtering and DNS block lists and monitor traffic to its resolved IP address for anomalous connections. Email gateways ought to reject or quarantine messages sent to or from the domain’s MX host. Continuous observation of the SSL certificate and any changes to the nameserver configuration is advised, as attackers often rotate infrastructure. Incident response teams should treat any credentials submitted to the site as compromised and enforce immediate password resets for affected accounts.