conanhunt[.]xyz

The domain conanhunt.xyz has been identified as a credential theft operation designed to impersonate a major consumer brand and harvest user login credentials. Analysis indicates the site employs social engineering tactics, including fake login portals and urgency-driven prompts, to deceive victims into submitting sensitive authentication details. The domain is currently offline, though historical activity suggests it may resume operations under similar infrastructure or rebranded variants. Infrastructure analysis reveals the domain was registered on April 04, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.72.66, which has been observed in prior malicious campaigns. Detection metrics show the domain was flagged by 6 of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0 out of 100. Additionally, conanhunt.xyz appears on one security blocklist, further corroborating its malicious classification. The use of a recently created domain with minimal detection coverage suggests an attempt to evade automated filtering systems. Current status indicates the domain has been taken offline, likely in response to detection or enforcement actions. However, the underlying threat persists, as actors behind such campaigns often rotate domains or reuse infrastructure. Organizations and end-users are advised to implement the following mitigations: block the domain and associated IP address at the network perimeter, deploy endpoint protection with real-time phishing detection, and conduct user awareness training to recognize credential theft tactics. Monitoring for newly registered domains under the same registrar or resolving to the same IP may help preempt future iterations of this campaign.