hcdistrictclerk[.]lgbuq[.]vip

This domain is flagged as a credential harvesting phishing site with an elevated risk level. Analysis indicates it was specifically designed to mimic legitimate government or institutional login portals, likely targeting users seeking access to county clerk services. The domain's infrastructure and detection metrics align with known phishing campaigns aimed at stealing sensitive authentication credentials. Infrastructure analysis reveals the domain was registered through Namemart Limited on June 12, 2026, an unusually future-dated creation that may indicate an attempt to evade detection or establish long-term campaign infrastructure. It resolves to IP address 104.21.46.207, a Cloudflare-associated endpoint commonly used to mask malicious infrastructure. The domain appears on one security blocklist and is flagged by 12 out of 95 security vendors on VirusTotal, including detections for phishing and malicious content. Despite using a Google Trust Services SSL certificate, this does not indicate legitimacy, as phishing operators frequently abuse free or automated certificate issuance to appear trustworthy. Organizations and users should implement the following mitigation measures specific to credential harvesting threats: Immediately block the domain and its resolving IP (104.21.46.207) at the network perimeter. Conduct a retrospective analysis of logs to identify any prior connections to this domain or IP, particularly from systems that handle sensitive authentication. Reset credentials for any accounts that may have interacted with this domain, prioritizing those with elevated privileges. Deploy email and web filtering rules to prevent delivery or access to similar phishing domains, focusing on patterns that mimic government or institutional naming conventions. Monitor for follow-on attacks, as credential harvesting often precedes more targeted intrusion attempts.