autoconfig[.]designtingleflowx[.]shop

This domain, autoconfig.designtingleflowx.shop, is identified as a high-risk phishing infrastructure designed to impersonate the legitimate mail interface of codora.shop. The page title explicitly displays 'mail.codora.shop - mail UI,' indicating an attempt to deceive users into believing they are accessing a genuine email service. While no specific drainer kit or brand impersonation beyond codora.shop is confirmed, the domain's structure and page content strongly suggest credential harvesting targeting users of the impersonated platform. Analysis of technical indicators reveals significant red flags. The domain is flagged by 13 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as phishing. Registered through Spaceship, Inc. on April 23, 2025, the domain resolves to the IP address 65.21.205.126, hosted on AS24940 (Hetzner Online GmbH) in Finland. The SSL certificate is issued by Let's Encrypt (serial number E7), a common tool used by both legitimate and malicious actors. The domain appears on at least one security blocklist, further corroborating its malicious intent. As of the latest assessment, autoconfig.designtingleflowx.shop has been taken offline, reducing immediate exposure risk. However, the infrastructure may resurface under a different domain or IP address, a common tactic in phishing campaigns. Users who accessed the site prior to its takedown should assume credential compromise and take immediate action, including password resets for any accounts accessed during the exposure window. Organizations should monitor for similar domains registered via Spaceship, Inc. or resolving to the same IP range, as these may indicate related malicious activity. Network defenders are advised to block the domain and associated IP at perimeter security controls to prevent future access attempts.