night-market[.]cc

This domain, night-market.cc, operates as a fake login portal designed to harvest user credentials through an 'Access Verification' page. Analysis indicates the site mimics legitimate authentication flows, presenting victims with a seemingly valid login interface to capture usernames, passwords, and potentially multi-factor authentication codes. The infrastructure is optimized for rapid deployment and evasion, leveraging Nginx and OpenResty to serve phishing content while minimizing detection footprints. No evidence of crypto drainer functionality or payment interception was observed, distinguishing this as a credential-focused operation rather than a financial asset theft campaign.

Evidence confirms the domain was registered on February 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Detection metrics reveal significant security vendor consensus, with 21 of 95 engines on VirusTotal flagging the domain as malicious. Infrastructure analysis shows the domain resolves to 217.60.39.100 and appears on three security blocklists, including PhishDestroy, PhishingArmy, and CERT-PL. Scamadviser and Gridinsoft both assign trust scores of 1/100 and 0/100, respectively, further validating its malicious classification. The domain has since been taken offline, though residual DNS records and cached content may persist in some networks.

Users who visited night-market.cc or interacted with its 'Access Verification' page should assume credential compromise. Immediate actions include resetting passwords for any accounts entered on the site, enabling multi-factor authentication where available, and monitoring linked accounts for unauthorized activity. System-level scans for malware are recommended, as phishing pages may deploy secondary payloads. Organizations should update internal blocklists to include the domain and its associated IP (217.60.39.100) to prevent future access. Given the domain's recent creation and registrar profile, similar infrastructure may emerge; network defenders should prioritize monitoring for domains registered through NICENIC INTERNATIONAL GROUP with comparable detection patterns.