eugamb[.]cc

eugamb.cc is a recently activated domain linked to an active credential theft campaign. Our analysis shows the site mimics legitimate login portals to harvest usernames and passwords, posing a direct risk to users who enter their credentials. The domain was registered on March 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP 188.114.97.3. Security vendors have flagged it with a 5/95 detection ratio, indicating limited but present recognition of its malicious nature. A Let's Encrypt SSL certificate further enhances its deceptive appearance, making it harder for users to distinguish from authentic sites. This threat follows a pattern of rapid domain creation and short-lived operations typical of credential theft campaigns. The low VirusTotal detection rate suggests evasion techniques are in use, such as dynamic hosting or delayed malicious payload activation. The domain's age—just days old—aligns with the aggressive timelines observed in these attacks, where threat actors prioritize speed over longevity to avoid detection. The registrar, NICENIC INTERNATIONAL GROUP CO., LIMITED, has been associated with numerous malicious domains in the past, further raising the risk profile of eugamb.cc. If you have visited eugamb.cc or entered any credentials, immediately change passwords on all accounts using the same or similar login details. Enable multi-factor authentication where available to add an extra layer of security. Scan your device for malware using reputable antivirus software, as stolen credentials may be leveraged for further attacks. Report the domain to your IT team or security provider and avoid interacting with it further. Monitor accounts closely for unusual activity, such as unauthorized logins or transactions, and report any suspicious behavior to the relevant platform or service provider.