chnaapro[.]vip

Analysis indicates that the domain chnaapro.vip was registered on May 12, 2026 and is currently taken offline. The site resolves to the IPv4 address 199.168.137.245, which is allocated to AS25820 IT7 Networks Inc in the United States. DNS resolution is served by magdalena.ns.cloudflare.com and vicky.ns.cloudflare.com, confirming registration through Cloudflare, Inc. The presented SSL certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, a standard domain‑validated certificate. The only observed page title is “Account login - CHNOBOR.COM”, consistent with a credential‑phishing lure.

Threat intelligence shows the domain appears on one security blocklist and has been referenced in two AlienVault OTX pulses. VirusTotal analysis recorded three detections out of ninety‑one scanned vendors, and the Gridinsoft trust score is 8 / 100, both suggesting malicious intent. PhishDestroy has already blocked the domain. The evidence collectively points to a credential‑phishing campaign targeting users of CHNOBOR.COM.

Uncertainties remain regarding the exact phishing kit, the presence of additional malicious payloads, and whether the domain will be re‑activated. Defenders should immediately add chnaapro.vip and its resolving IP 199.168.137.245 to network blocklists, monitor DNS queries for re‑registration, and enforce strict credential‑validation controls for any services that may be impersonated. Continuous threat‑intel feeds should be consulted for any new pulses or detection updates related to this infrastructure.