salesincreaseaccount[.]club

PhishDestroy has identified salesincreaseaccount.club as a credential phishing domain designed to steal login credentials from unsuspecting users. The site likely masquerades as a legitimate login page for a well-known service, tricking visitors into entering their usernames and passwords. These stolen credentials are then harvested by attackers for unauthorized access to accounts, potentially leading to data breaches, financial loss, or identity theft. The domain was registered on May 18, 2026, through NameMart Pte. Ltd., a registrar based in Singapore, and it resolves to the IP address 188.114.96.3, which is associated with Cloudflare's infrastructure. The SSL certificate was issued by Let's Encrypt (E7), a free certificate authority often abused by malicious actors to create an illusion of legitimacy.

Security analysis reveals significant red flags. VirusTotal flagged the domain with 19 out of 95 security vendors detecting malicious activity, indicating widespread recognition of its threat nature. Additionally, the domain appears on at least one security blocklist and is referenced in a single threat intelligence pulse on AlienVault OTX, suggesting it has been actively monitored by the security community. The combination of a recently created domain (just months old) with a generic name that implies sales or account management, coupled with high vendor detections, strongly supports the classification as a credential phishing campaign. While the domain is currently offline, its past activity poses risks to anyone who interacted with it.

Users who visited salesincreaseaccount.club or entered any credentials should immediately change their passwords for the affected accounts, especially if they reused passwords elsewhere. Enable two-factor authentication (2FA) on all accounts that support it, and monitor for suspicious activity such as unauthorized logins or password reset attempts. It is also advisable to run a full antivirus scan on the device used to access the site, as credential phishing pages sometimes deploy malware. PhishDestroy recommends verifying any similar domain through its platform before interacting with it, and staying vigilant against future phishing attempts that may reuse similar naming patterns or infrastructure.