wilsongroup[.]in

The domain wilsongroup.in is flagged as a generic phishing infrastructure and is currently offline. Evidence shows the domain was created on 24 April 2010 and is registered through Tucows Domains Inc. DNS resolution points to IP 184.154.118.6, which belongs to Internap Holding LLC in the United States. The web server presents a TLS certificate issued by Let’s Encrypt (R12) and enforces HSTS while supporting HTTP/3, yet the only observable response is an HTTP 403 status with the page title “403 Forbidden.” The site has been blocked by the PhishDestroy sinkhole and appears on one public security blocklist.

VirusTotal scans indicate that 12 of 91 scanned security vendors flagged the domain, suggesting a modest detection rate. AlienVault OTX references the domain in three separate threat intelligence pulses, reinforcing its association with malicious activity. While the offline state limits immediate observation of phishing content, the combination of registrar information, hosting attribution, TLS usage, and vendor detections provides sufficient confidence to treat the domain as a confirmed phishing site.

Defenders should continue to block the domain at network perimeters, add the IP address to deny lists, and monitor for any resurrection attempts. Threat hunters should query recent logs for connections to 184.154.118.6 and verify that any residual credentials or cookies associated with wilsongroup.in are purged. Ongoing surveillance of the registrar and hosting provider is advisable, as similar domains may be provisioned using the same infrastructure.