cmhliassets[.]federalnewsmagazine[.]com

Analysis of the domain cmhliassets.federalnewsmagazine.com indicates it was actively used in a phishing campaign impersonating Cofense, a known cybersecurity awareness training provider. The domain, registered on March 23, 2026, through MarkMonitor Inc., resolved to IP address 34.194.247.17, hosted on AWS EC2 in the US (us-east-1 region). Infrastructure review shows the domain used four AWS nameservers and a Let's Encrypt SSL certificate, with HSTS enabled, suggesting an attempt to appear legitimate. At the time of investigation, the domain returned an HTTP 404 status, but its page title, '404 - Quick Tip | Cofense,' confirms the intended brand impersonation.

Security vendors have flagged this domain, with 18 of 94 engines on VirusTotal detecting it as malicious. It appears on at least one security blocklist and was blocked by PhishDestroy. The domain is currently offline, though its infrastructure remains registered.

Defenders should treat this domain as part of a broader phishing campaign targeting Cofense users or related security training platforms. While the exact payload or phishing kit is not confirmed, the combination of brand impersonation, hosting on a major cloud provider, and detection by multiple security tools warrants elevated monitoring. Organizations should review logs for connections to 34.194.247.17 or the domain itself, particularly if Cofense-related communications were expected during the domain's active period.