1111365wz[.]cc

This domain, 1111365wz.cc, is a brand impersonation threat designed to mimic Gmail login pages. Its primary objective is credential harvesting, where attackers trick users into entering their email addresses and passwords, which are then captured for unauthorized access to accounts. The site was observed displaying a page title for bet365, a discrepancy that further indicates malicious intent, as it suggests an attempt to deceive users or redirect them to unrelated gambling content after stealing credentials. Such tactics are common in phishing campaigns targeting high-value platforms like email services to facilitate further attacks, including identity theft or financial fraud. Analysis indicates this domain is a confirmed threat based on multiple technical indicators. It was created on February 18, 2025, and registered through GoDaddy.com, LLC, a registrar frequently abused for malicious domains due to its accessibility. The domain resolves to the IP address 35.194.113.68, hosted on Google LLC infrastructure in Japan (AS396982). Security vendors flagged it aggressively, with 21 out of 95 engines on VirusTotal detecting it as malicious. Additionally, it appears on two security blocklists, PhishDestroy and PhishingDB, and uses a Let's Encrypt SSL certificate, which attackers often exploit to create a false sense of legitimacy. The combination of these factors confirms its role in a phishing operation. If you visited 1111365wz.cc or entered any credentials on the site, immediate action is required. First, change the password for the affected Gmail account and enable multi-factor authentication if not already active. Review the account for any unauthorized activity, such as sent emails, login attempts from unfamiliar locations, or changes to recovery settings. Scan your device for malware, as phishing sites may also distribute malicious payloads. Report the incident to your organization's security team if the account is work-related, or to the appropriate platform if personal. Monitor linked accounts, such as financial services or social media, for signs of compromise, as attackers may attempt to exploit the stolen credentials elsewhere.