login[.]sf[.]tumee[.]com

The domain login.sf.tumee.com is currently flagged as an active credential phishing site, specifically designed to impersonate Salesforce login portals. Analysis confirms its status as a high-risk threat, with the primary objective of harvesting user credentials through fraudulent authentication interfaces. The domain presents a convincing replica of the legitimate Salesforce login page, increasing the likelihood of successful deception. Infrastructure analysis reveals the following technical indicators: the domain was registered on September 09, 2007, through NAMECHEAP INC, and currently resolves to the IP address 104.18.8.67. Security vendor assessments on VirusTotal indicate that 4 out of 95 vendors have flagged this domain as malicious. The SSL certificate is issued by Google Trust Services, which, while valid, does not mitigate the underlying phishing threat. No additional blocklist entries or trust score deviations were identified beyond the VirusTotal detections, though the domain's age and hosting infrastructure suggest a deliberate effort to evade detection. Current evidence confirms that login.sf.tumee.com remains operational and continues to pose a significant risk to users. Organizations and individuals are advised to block access to this domain at the network level and implement email filtering rules to prevent delivery of messages containing this URL. End-users should be alerted to the threat, particularly those with access to Salesforce environments, and instructed to verify domain authenticity before entering credentials. Monitoring for related indicators of compromise, such as unusual login attempts or unauthorized access, is strongly recommended.