mail[.]runwagokyc[.]live

This domain, mail.runwagokyc.live, is identified as a credential harvesting phishing infrastructure designed to impersonate Runwago services. The site presents a fraudulent login interface under the page title "Runwago," aiming to deceive users into submitting sensitive credentials such as usernames, passwords, or financial details. Credential harvesting remains a prevalent tactic, with attackers leveraging lookalike domains and cloned interfaces to exploit trust in legitimate brands. The domain's infrastructure and content are engineered to evade casual detection while maximizing victim engagement through social engineering techniques. Analysis indicates the domain is registered through an anonymized provider linked to the IP range 192.3.190.184/29 under ASN 36352. It resolves to the specific IP address 192.3.190.186 and is currently offline. Security validation reveals 3 out of 95 detection engines on VirusTotal flagged the domain as malicious, while Gridinsoft assigned a trust score of 0/100. The domain appears on at least one security blocklist and was actively blocked by PhishDestroy. Technical fingerprinting detected the use of LiteSpeed web server software and support for HTTP/3, suggesting modernized infrastructure optimized for performance and evasion. Users who visited mail.runwagokyc.live or entered credentials on the site should immediately revoke access to any submitted accounts and enable multi-factor authentication where available. Monitor linked financial and communication platforms for unauthorized activity, as harvested credentials are frequently exploited within hours of compromise. Reset passwords using a secure, unrelated device and avoid reusing credentials across services. Organizations should update internal blocklists to include this domain and its resolving IP to prevent future access attempts. If browser sessions were active during the visit, clear cached data and run a full system scan to detect potential secondary infections.