919xpj[.]com

Analysis of 919xpj.com indicates a generic phishing domain targeting Chinese-speaking users, as suggested by the page title '欢迎' (Welcome). The domain was registered on March 16, 2022, through GoDaddy.com, LLC, and was last observed resolving to IP 45.138.71.205, hosted on AS35251 (NetLab Global) in the US. Cloudflare nameservers (ishaan.ns.cloudflare.com, leah.ns.cloudflare.com) are in use, a common pattern for phishing infrastructure to obscure hosting origins. No SSL certificate was detected, increasing the likelihood of interception or man-in-the-middle risks for visitors.

The domain appears in 16 AlienVault OTX threat intelligence pulses, suggesting recurring malicious activity. It is flagged by 12 of 95 security vendors on VirusTotal and is present on at least one security blocklist. PhishDestroy has blocked the domain, and it currently holds a Scamadviser trust score of 1/100 and a Gridinsoft trust score of 0/100, reinforcing its classification as high-risk. As of July 23, 2026, the domain is offline, but historical infrastructure may still pose residual threats if repurposed.

Defenders should treat this domain as compromised and prioritize blocking it at DNS, proxy, and endpoint levels. Monitor for re-registration or IP reuse under new domains, particularly those leveraging Cloudflare nameservers or the same hosting provider. The absence of SSL and the use of a generic 'Welcome' page title suggest a low-effort phishing kit, but the domain's inclusion in multiple threat intelligence feeds indicates persistent abuse. No specific brand or scam type has been confirmed, so detection rules should focus on the domain name, IP, and associated infrastructure rather than assumed targets.