tmp[.]e-shindanshi[.]com

This domain, tmp.e-shindanshi.com, is currently flagged as an active phishing infrastructure targeting users through a WordPress-hosted page. Analysis indicates the site is operational, returning an HTTP 200 status, though it displays a 'Site is undergoing maintenance' message. The domain was registered on December 06, 2024, through GMO Internet, Inc., and is hosted on infrastructure associated with XSERVER Inc. in Japan, resolving to the IP address 183.181.97.23. The nameservers—ns1.xserver.jp through ns5.xserver.jp—further confirm its association with a commercial hosting provider commonly exploited for phishing operations. Technical indicators reveal the use of WordPress, MySQL, PHP, and Nginx, alongside client-side libraries such as jQuery and jQuery Migrate. The SSL certificate is issued by Let’s Encrypt (R13), a common choice for both legitimate and malicious sites due to its free and automated issuance process. While the maintenance message may suggest an attempt to evade detection or prepare for a live phishing campaign, the domain has already been flagged by 19 out of 95 security vendors on VirusTotal, reinforcing its classification as a high-risk phishing resource. It also appears on at least one security blocklist, and independent scoring systems assign it a trust rating of 0 out of 100. The infrastructure’s persistence—remaining active despite detection—suggests it may be part of a broader, automated phishing operation. Defenders should treat this domain as compromised and implement blocking measures at the network and endpoint levels. Monitoring for changes in page content or behavior is recommended, as the current maintenance notice could transition to an active phishing page at any time. Given the domain’s registration age and hosting environment, it is likely to remain a threat vector unless taken down by the hosting provider or registrar.