613823[.]com

The domain 613823.com is currently active and functions as a credential theft operation designed to harvest user login credentials, financial details, or other sensitive information. Analysis indicates this is not a generic phishing attempt but a targeted scheme likely impersonating a legitimate service to deceive victims into disclosing confidential data. The domain remains operational, posing an ongoing risk to unsuspecting users. Infrastructure analysis reveals multiple high-risk indicators. The domain resolves to the IP address 19.200.13.201 and was registered on July 06, 2026, through Dominet (HK) Limited, a registrar frequently associated with fraudulent activity. Security vendors on VirusTotal have flagged this domain as malicious, with 11 out of 95 engines detecting it as a threat. The SSL certificate is issued by Let’s Encrypt, a common tactic among threat actors to create a false sense of security. Additionally, the domain appears in one threat intelligence pulse on AlienVault OTX, further confirming its malicious nature. The page title, rendered as non-standard characters (欢迎光临), suggests obfuscation techniques to evade detection or target non-English-speaking users. Current status confirms the domain remains active and continues to host credential theft infrastructure. Users are strongly advised to avoid interacting with this domain, including clicking links or entering any personal information. Organizations should block the domain and its associated IP address (19.200.13.201) at the network level to prevent access. Individuals who may have already visited the site should monitor accounts for unauthorized activity, reset passwords using a secure device, and enable multi-factor authentication where available. Given the high-risk indicators, this domain should be treated as a confirmed threat until further remediation is observed.