webmail[.]367450[.]com

The domain webmail.367450.com is currently active and classified as a generic phishing threat with an elevated risk rating. Infrastructure analysis shows it resolves to the IPv4 address 3.104.102.7. VirusTotal scanning has returned 15 positive detections out of 91 submitted security engines, indicating a moderate level of vendor consensus on malicious behavior. The domain is listed on a single public blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one commercial phishing mitigation platform has taken action against it.

No additional evidence such as SSL certificate details, HTTP response codes, page title, or Safe Browsing verdicts are available in the current intelligence set, so the full scope of the hosted payload or credential‑stealing page cannot be confirmed. The absence of further artefacts does not imply benign intent; the existing detections are sufficient to treat the domain as hostile. Defenders should immediately add 3.104.102.7 and the hostname webmail.367450.com to outbound and inbound deny lists, enforce DNS sinkholing for the name, and ensure that email gateway filters are configured to flag any messages containing URLs that resolve to this address. Network intrusion detection signatures should be updated to include the observed IP, and any existing traffic logs should be searched for prior connections to the host.

Continuous monitoring of threat‑intel feeds for additional blocklist appearances or increased VT detections is advised. If compromised credentials are suspected, organization‑wide password resets for affected services should be considered. Given the current evidence, the domain should be treated as malicious and blocked across all enforcement points until further analysis either confirms remediation or reveals a change in behavior.