in[.]ids-demo[.]me

This domain, in.ids-demo.me, is identified as a credential harvesting phishing site targeting users through deceptive landing pages. Analysis indicates the domain is designed to mimic legitimate authentication portals, tricking visitors into submitting sensitive login credentials, personal data, or financial information. The use of a generic 'Coming Soon' page title suggests an attempt to mask malicious intent while infrastructure is prepared for active exploitation, a common tactic in pre-operational phishing campaigns. Infrastructure analysis reveals the domain was registered on March 05, 2026, through GoDaddy.com, LLC, and currently resolves to the IP address 50.87.153.103. Security vendor detections on VirusTotal show 7 out of 95 engines flagging the domain as malicious, while it appears on at least one security blocklist. The domain utilizes an Apache HTTP Server and a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. The Gridinsoft trust score of 0/100 further corroborates the domain's association with phishing activity. Users who have visited in.ids-demo.me or interacted with its content should immediately cease all engagement and perform a security review. Clear browser cache and cookies to remove any residual tracking elements, and scan local systems for malware using updated security tools. If credentials were entered, reset passwords for all potentially compromised accounts, prioritizing email, financial, and work-related platforms. Monitor accounts for unauthorized activity and enable multi-factor authentication where available. Network administrators should block the domain and its resolving IP at the perimeter to prevent further exposure.