cngspex[.]com

This domain is flagged as a high-risk credential harvesting phishing site targeting user authentication data. Analysis indicates the infrastructure is designed to deceive victims into submitting login credentials, payment details, or other sensitive information under the guise of a legitimate service. The threat type aligns with generic phishing but exhibits characteristics of targeted credential theft, increasing its potential impact on individuals and organizations. Infrastructure analysis reveals the domain cngspex.com was registered on June 20, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar with a history of hosting malicious domains. It currently resolves to the IP address 163.181.131.236, which has been associated with prior phishing campaigns. Detection metrics show limited but concerning visibility: only 1 of 95 security vendors on VirusTotal flag the domain, while Gridinsoft assigns a trust score of 42 out of 100. The domain appears in one AlienVault OTX threat intelligence pulse, suggesting recent inclusion in shared blocklists. The SSL certificate is issued by Let's Encrypt, a tactic commonly employed to lend false legitimacy to phishing sites by enabling HTTPS encryption. Mitigation steps should prioritize blocking the domain and its associated IP at the network perimeter. Organizations are advised to update endpoint protection rules to detect and prevent access to cngspex.com, particularly in environments where credential harvesting poses a high risk. User awareness training should emphasize the risks of entering credentials on unfamiliar sites, even those using HTTPS. Security teams should monitor for indicators of compromise, including the IP 163.181.131.236 and the domain registrar Fewmoretaps OU, to identify related threats. Given the domain's recent creation and low detection rate, proactive hunting for similar infrastructure is recommended to preempt further abuse.