web-groupcontinentaleurope[.]com

web-groupcontinentaleurope.com has been identified as a high‑risk credential‑harvesting site. The domain was registered on 28 April 2026 by Fewmoretaps OU operating as Trustname.com, and its short lifespan combined with immediate detection indicates a purpose‑built phishing campaign. The site returns HTTP 200 responses and presents a valid SSL certificate issued by Google Trust Services under the WE1 series, which can lend deceptive legitimacy to unsuspecting victims. The domain is hosted on Cloudflare’s network, resolving to IP address 188.114.96.3 located in Canada and serviced by the nameservers gemma.ns.cloudflare.com and lewis.ns.cloudflare.com. Use of Cloudflare’s edge infrastructure is a common tactic to obscure the true origin of malicious sites and to benefit from the provider’s built‑in DDoS mitigation. No additional hosting details are disclosed beyond the Cloudflare association. Open‑source threat feeds provide limited but corroborating evidence. AlienVault OTX lists the domain in a single pulse, and the Gridinsoft trust score is 0 out of 100, reflecting extreme suspicion. PhishDestroy has already blocked the domain, and it appears on one external security blocklist. VirusTotal scans show that four of ninety‑five security vendors flagged the domain, reinforcing the malicious assessment despite a modest detection count. While the available data confirms the domain’s active status and its alignment with credential‑harvesting operations, the specific phishing kit or targeted brand remains unknown. Defenders should block DNS resolution to 188.114.96.3, enforce HTTPS inspection to detect the legitimate Google certificate being used for malicious purposes, and monitor for any email or web traffic referencing web‑groupcontinentaleurope.com. Continuous re‑evaluation is advised, as threat actors may shift infrastructure or repurpose the domain.