v55000[.]cc

Analysis of v55000.cc indicates an active credential‑phishing infrastructure. The domain was registered on 7 June 2026 via NameSilo, LLC and resolves to IP 23.224.199.170, which is hosted by CloudRadium L.L.C in the United States. HTTP requests return status 200 and the site presents an SSL certificate issued by ZeroSSL GmbH (ZeroSSL ECC DV SSL CA 2). The page title returned is “妖精视频”, and automated fingerprinting identifies a Node.js stack employing Vue.js, Nuxt.js, Tengine and HSTS. The domain appears on three public blocklists and is listed in two AlienVault OTX pulses. It is also blocked by PhishDestroy, MetaMask and SEAL. VirusTotal scans show six of ninety‑one scanners flagging the domain, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The observed indicators confirm the site’s use for credential collection, though the specific targeted services or credential types have not been disclosed. Defenders should block the domain and its resolved IP, monitor for related DNS or HTTP traffic, and update detection rules to include the observed TLS fingerprint and technology stack. Continued observation is advised to capture any payload changes or expanded targeting.