ui4[.]neibu168[.]com

Analysis of the domain ui4.neibu168.com indicates active participation in a cryptocurrency phishing campaign. The domain was registered on November 5, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. Current infrastructure resolves to the IP address 188.114.97.3, which has been linked to multiple phishing operations targeting wallet credentials and token transfers. The SSL certificate issued by Google Trust Services provides a superficial layer of legitimacy, though this is a common tactic to evade initial suspicion. Security vendors have flagged this domain with notable consistency. Six out of ninety-five vendors on VirusTotal classify ui4.neibu168.com as malicious, while five independent security blocklists have included it in their denylists. Detection engines such as SEAL, MetaMask, ScamSniffer, PhishDestroy, and BLP-Malware have all marked the domain as a confirmed threat, suggesting a coordinated effort to deceive users into divulging sensitive information. The page title, 'Demo Desigh Site,' appears intentionally vague, likely designed to obscure the true nature of the operation while maintaining a facade of plausibility. The domain remains active as of July 12, 2026, with no indications of takedown or mitigation efforts. Gridinsoft’s trust score of 0/100 further corroborates the high-risk classification, reflecting a complete absence of reputable associations. While the exact phishing kit or targeted brand remains unconfirmed, the infrastructure and detection patterns align with known campaigns aimed at cryptocurrency theft. Defenders should prioritize blocking this domain at the network level and monitoring for related indicators of compromise, particularly in environments where wallet interactions or token transactions occur. Organizations are advised to treat any interaction with ui4.neibu168.com as a potential security incident requiring immediate investigation.