darkwebsupplies[.]com

This domain is flagged as an elevated-risk generic_phishing threat targeting retail and e-commerce credentials. Analysis indicates the site impersonates legitimate tobacco or supply stores to deceive users into submitting sensitive information, including login credentials and financial details. The domain exhibits characteristics consistent with credential harvesting campaigns, including the use of deceptive page titles and infrastructure designed to evade detection. Infrastructure analysis reveals the following technical indicators: the domain was registered on December 18, 2022, through NAMECHEAP INC and currently resolves to IP address 172.67.207.218. It is detected by 2 out of 95 security vendors on VirusTotal and appears on one security blocklist. The domain was previously blocked by at least one threat intelligence platform and is referenced in two AlienVault OTX threat intelligence pulses. Technologies detected include Cloudflare, Cloudflare Browser Insights, and HTTP/3, which may be leveraged to obscure malicious activity or enhance performance for phishing operations. Mitigation for this threat involves immediate blocking of the domain and its associated IP address (172.67.207.218) at the network perimeter. Organizations should monitor for outbound connections to this domain or IP, particularly from endpoints accessing retail or e-commerce platforms. End-user training should emphasize recognizing phishing attempts that mimic legitimate supply or retail sites, including verifying domain registration dates and scrutinizing page titles for inconsistencies. Security teams are advised to review logs for prior interactions with this domain and conduct retrospective analysis to identify potential credential exposure or unauthorized access attempts.