gaenshuai[.]it[.]com

This domain, gaenshuai.it.com, is identified as a brand_impersonation threat targeting users of the social media platform X.com. Analysis indicates the infrastructure is designed to mimic legitimate X.com login interfaces, likely to harvest user credentials through deceptive input forms. The presence of Microsoft ASP.NET and Kestrel technologies suggests a server-side framework commonly exploited for phishing operations, enabling dynamic content delivery tailored to victims. Infrastructure analysis reveals the domain resolves to the IP address 185.196.11.72 and was registered through UK Intis Telecom Ltd on October 23, 1992, an unusually early creation date that may indicate domain repurposing. Detection metrics show 1 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single security blocklist. The Gridinsoft trust score of 0/100 further corroborates its high-risk classification, and the domain has since been taken offline following enforcement actions. Users who accessed gaenshuai.it.com or entered credentials on any page hosted under this domain should immediately revoke access to any sessions associated with X.com. It is recommended to reset passwords using multi-factor authentication and monitor linked accounts for unauthorized activity. Network administrators should update perimeter defenses to block the IP address 185.196.11.72 and audit logs for connections to this infrastructure. Given the elevated risk level, affected users should also review financial and communication platforms tied to the compromised account for signs of lateral movement or secondary attacks.