illuminatiofficialmembers[.]org

illuminatiofficialmembers.org was first observed on March 7 2026 when it was registered through NiceNIC International Group Co., Limited. The domain resolves to the IPv4 address 67.211.219.227, which is assigned to AS19318 (Interserver, Inc.) in the United States. The site serves content over HTTPS using a Let's Encrypt certificate (YR2) and responds with HTTP 200. The page title returned by the server is identical to the domain name.

The authoritative name servers are dns2005a.trouble-free.net and dns2005b.trouble-free.net, both typical of free DNS hosting services. The web server identifies itself as LiteSpeed and supports HTTP/3, indicating a modern front‑end configuration. Reputation checks show a Gridinsoft trust score of 0/100 and a single entry on a security blocklist. The domain is listed as blocked by PhishDestroy and has been flagged by one of ninety‑five VirusTotal security vendors.

Threat intelligence categorizes the site as a generic phishing portal. The classification is supported by the observed page title, the lack of legitimate branding, and the presence of a generic landing page that typically harvests credentials. No additional malicious payloads or redirects were captured during the observation, leaving the exact phishing lure unknown. The low trust score and the single blocklist entry suggest that the infrastructure is newly deployed and may be used in targeted campaigns.

Defenders should add illuminatiofficialmembers.org and its resolving IP 67.211.219.227 to deny‑list rules at network borders and endpoint filters. Continuous monitoring of the associated nameservers and certificate issuance can provide early warning of further activity. Given the active status and high risk rating, security teams are advised to treat any email or communication referencing the domain as potentially malicious and to educate users about the likelihood of credential theft.