americanmovingco[.]org

This domain is flagged for elevated-risk credential harvesting phishing activity targeting individuals seeking relocation services. Analysis indicates americanmovingco.org is designed to impersonate legitimate moving companies, tricking users into submitting sensitive login credentials, financial details, or personal information through fraudulent web forms. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on March 02, 2026, through NAMECHEAP INC, a registrar frequently associated with malicious registrations. It resolves to the IP address 192.185.31.183, which has been linked to prior phishing campaigns. Security vendors on VirusTotal flag the domain at a 9/95 detection rate, indicating near-universal consensus on its malicious nature. The domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt, is commonly exploited by threat actors to lend false legitimacy to phishing sites. The creation date, well in advance of typical legitimate business registrations, further suggests premeditated malicious intent. To mitigate risks associated with credential harvesting phishing, organizations and individuals should immediately block access to americanmovingco.org at the network level. Security teams should deploy indicators of compromise (IOCs) including the domain, IP 192.185.31.183, and associated SSL certificate thumbprints into endpoint detection and response (EDR) systems. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window, particularly if reused across platforms. Multi-factor authentication (MFA) should be enforced for all critical accounts to reduce the impact of stolen credentials. Network monitoring should be heightened for traffic patterns matching this domain or its resolved IP to detect potential lateral movement or data exfiltration attempts.