tmo[.]attorneyuczzpa[.]tokyo

This domain is classified as a high-risk credential harvesting phishing site. Analysis indicates it is actively used to deceive users into submitting login credentials through fraudulent interfaces designed to mimic legitimate services. The threat type is specifically targeted at capturing sensitive authentication data, which can lead to unauthorized account access and subsequent data breaches. Infrastructure analysis reveals the domain tmo.attorneyuczzpa.tokyo is flagged by 22 out of 95 security vendors on VirusTotal, with an additional presence on one security blocklist. It is registered through GMO Internet Group, Inc., and resolves to the IP address 148.178.177.132, hosted on AS54801 (Zillion Network Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (YE1), and Google Safe Browsing has explicitly marked it as a phishing site. The domain remains active and is currently blocked by PhishDestroy, confirming its malicious status. Mitigation steps for this threat include immediate blacklisting of the domain and its associated IP address (148.178.177.132) across all network security controls. Organizations should deploy email and web filtering rules to prevent user access to the domain, particularly in environments where credential harvesting attempts are likely. End-user training should emphasize recognizing phishing indicators, such as suspicious domain names and untrusted SSL certificates. Additionally, monitoring for authentication attempts from the identified IP address can help detect compromised accounts.