campins[.]info

This domain, campins.info, presents a counterfeit replica of the official China Petroleum & Chemical Corporation (Sinopec) fuel card recharge portal. Analysis indicates the site is engineered to deceive users into submitting payment card details under the guise of legitimate fuel card top-up services. The page title, "中石化加油卡充值 - 中国石化网上营业厅充值官网," directly mimics the branding and terminology of Sinopec’s authentic online service platform, increasing the likelihood of successful social engineering attacks targeting Chinese-speaking users. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on May 9, 2025, through Dynadot LLC, a registrar frequently associated with phishing operations. It resolves to the IP address 45.136.12.147 and is currently flagged by 12 out of 95 security vendors on VirusTotal, with detection labels including generic phishing and credential theft. The domain appears on one security blocklist and has received trust scores of 1/100 and 0/100 from independent assessment platforms. Technologies detected on the site include Bootstrap, Nginx, jsDelivr, and HTTP Strict Transport Security (HSTS), suggesting an attempt to mimic legitimate e-commerce infrastructure. Users who accessed campins.info or entered sensitive information are advised to take immediate remedial action. All credentials submitted should be considered compromised and must be changed across all platforms where reused. Financial institutions should be notified to monitor for unauthorized transactions. Devices used to access the site should undergo malware scanning, as phishing pages may deploy secondary payloads. Network-level blocking of the IP 45.136.12.147 and domain campins.info is recommended to prevent further exposure. Organizations should update endpoint protection rules to include this domain and its associated indicators in threat intelligence feeds.