l0glnn-m1croqx0qftcom-0utloolx1drvvefil3es[.]fwh[.]is

This domain is identified as a fake login portal designed to harvest user credentials through deceptive authentication interfaces. Analysis indicates the site mimicked legitimate login pages, likely targeting users of a specific service or platform by replicating its visual and functional elements to induce trust and prompt credential submission. The domain infrastructure was structured to evade casual detection, using obfuscated subdomains and a hosting provider known for permissive registration policies. Infrastructure analysis reveals the domain was registered on June 08, 2026, through FreeWebHostingArea, a registrar frequently associated with low-cost or free hosting solutions. It resolved to the IP address 185.27.134.119 and was secured with an SSL certificate issued by ZeroSSL GmbH under the ZeroSSL ECC DV SSL CA 2 intermediate. The domain appears on one security blocklist and is flagged by 22 out of 95 security vendors on VirusTotal, indicating a moderate but consistent detection rate across multiple engines. The domain has since been taken offline, though residual risks may persist from cached or archived copies. Users who visited this domain or entered credentials on its interface should immediately revoke any submitted information by changing passwords for all associated accounts, particularly those with reused credentials. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor accounts for unusual activity, such as unauthorized logins or transactions, and report any suspicious behavior to the respective service providers. If browser sessions were active during the interaction, clear cached data and cookies to eliminate stored session tokens. Organizations should update internal blocklists to include this domain and its associated IP address to prevent future access attempts.