login-salesforce[.]com

The domain login-salesforce.com is currently listed as an active credential phishing site. According to the latest intelligence, the domain was blocked by PhishDestroy and appears on one public security blocklist. VirusTotal analysis shows that three of ninety‑one scanning engines have flagged the domain as malicious, indicating that at least a subset of security vendors recognize it as part of a phishing campaign. The risk rating assigned by the reporting system is elevated, and the operational status is marked as active, confirming that the infrastructure is still in use.

No additional metadata such as registrar details, hosting IP, ASN, SSL certificate information, or page title has been released in the available feed, so the underlying hosting environment and the exact content served by the site remain unknown. Because the domain name mimics a legitimate Salesforce login URL, it is likely intended to harvest credentials from unsuspecting users, but the precise phishing kit or template has not been disclosed. Defenders should prioritize immediate containment measures. The domain should be added to URL filtering rules and DNS blocklists across enterprise perimeter devices.

Endpoint protection solutions that integrate VirusTotal verdicts can leverage the three positive detections to raise alerts on any attempted connections. Continuous monitoring of threat intelligence feeds for new indicators—such as associated IP addresses, certificate hashes, or related domains—will help expand detection coverage as the campaign evolves. Organizations are advised to educate users about the risk of entering credentials on unexpected login pages and to enforce multi‑factor authentication wherever possible to mitigate credential compromise.