id627191102[.]live

This domain, id627191102.live, is identified as a credential harvesting phishing site designed to deceive users into submitting login credentials. Analysis confirms the domain is currently offline, though prior activity indicates it was actively used for phishing campaigns. No specific brand impersonation has been confirmed, but the infrastructure aligns with generic credential theft operations. Infrastructure analysis reveals the domain was registered on June 17, 2025, through Web Commerce Communications Limited dba WebNic.cc. It resolved to the IP address 216.120.147.200 and appears in 6 threat intelligence pulses on a major threat-sharing platform. Security vendor assessments show 3 of 95 engines flagged the domain as malicious, while it is listed on 1 security blocklist. The domain’s creation date and rapid inclusion in threat feeds suggest a short-lived but targeted phishing operation. The domain is currently offline, reducing immediate risk, but historical indicators remain relevant for detection and prevention. Organizations are advised to block the domain and its associated IP (216.120.147.200) at the network perimeter. Security teams should review logs for connections to this domain or IP, particularly from June to August 2025. Endpoint protection rules should be updated to include this domain in phishing detection signatures, and users should be reminded to verify domain authenticity before entering credentials.