imcarrental[.]com

This domain is flagged for brand impersonation phishing, targeting users through a fraudulent car rental service portal. The threat level is elevated due to its deceptive branding and active distribution in phishing campaigns, despite its current offline status. Analysis indicates the domain was designed to mimic legitimate rental services, likely to harvest credentials or payment details from victims. Infrastructure analysis reveals the domain imcarrental.com was registered on June 19, 2025, through GoDaddy.com, LLC, and resolves to the IP address 50.6.7.251 (AS31898, Oracle Corporation, US). It is listed on two security blocklists and has been flagged by 12 out of 95 security vendors on VirusTotal. The page title, 'IM Car Rental – Choose Your Destination, We’ll Handle the Ride,' reinforces the impersonation theme, while the SSL certificate, issued by Let's Encrypt (R13), provides a superficial layer of legitimacy. The domain’s recent creation and rapid inclusion in blocklists suggest a coordinated phishing operation. Mitigation for this threat involves blocking the domain and its associated IP at the network level, particularly in environments where financial or personal data transactions occur. Organizations should monitor for similar impersonation patterns, such as domains using 'car rental' or related service keywords combined with generic branding. End-users should be educated to verify domain authenticity before entering credentials or payment details, especially when redirected from unsolicited communications. Security teams are advised to review logs for connections to 50.6.7.251 or related infrastructure to identify potential compromises.