3656v9[.]com

The domain 3656v9.com is currently engaged in high-risk brand impersonation, targeting Microsoft. This domain was registered on June 12, 2026, and is still active as of the report date. The page title found is '验证', which suggests the site may be prompting users to verify their credentials or other personal information. The domain resolves to the IP address 20.187.146.25 and is using jQuery UI, jQuery CDN, and jQuery for its web technologies. The SSL certificate is issued by Let's Encrypt, which is common for legitimate and malicious sites alike. Analysis indicates that the domain has been referenced in 18 threat intelligence pulses on AlienVault OTX and appears on two security blocklists. The Gridinsoft trust score for this domain is 0/100, indicating a complete lack of trust. The domain is blocked by PhishDestroy and BLP-Malware, further confirming its malicious nature. Given the high risk level and the current active status, defenders are advised to implement blocking rules for this domain and monitor for any related indicators of compromise. It is also recommended to educate users about the dangers of brand impersonation and the importance of verifying URLs and digital certificates before entering any sensitive information.