insidersxclusiveconnect[.]io

This domain, insidersxclusiveconnect.io, is assessed as a high-risk credential harvesting phishing threat. Analysis indicates the infrastructure is designed to mimic legitimate corporate login portals, likely targeting enterprise users to harvest credentials such as email, VPN, or single sign-on (SSO) details. The domain exhibits multiple technical indicators consistent with phishing campaigns, including the use of Cloudflare IP space and a low-trust SSL certificate profile. Infrastructure analysis reveals the domain was registered on February 21, 2026, and resolves to the IP address 104.21.36.4, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is categorized under the WE1 trust tier, which is frequently associated with low-reputation or disposable certificates used in phishing operations. At the time of assessment, the domain was flagged by 13 out of 95 security vendors on VirusTotal, and appears on three independent blocklists: PhishDestroy, ScamSniffer, and PhishingDB. The domain has since been taken offline, though historical resolution and certificate data remain relevant for retrospective detection. Mitigation against this threat involves implementing domain-based blocking at the network perimeter, particularly for the resolved IP 104.21.36.4 and associated Cloudflare ranges. Security teams should update endpoint protection rules to detect and prevent access to domains with WE1-class SSL certificates, especially those created within the last 90 days. User awareness training should emphasize verification of domain authenticity before entering credentials, particularly for portals claiming to be internal or partner-facing. Log monitoring should prioritize failed authentication attempts from endpoints that previously accessed this domain, as compromised credentials may still be in use.