delta-careers[.]com

This domain, delta-careers.com, operates as a fraudulent job recruitment portal designed to harvest personal and financial information from job seekers. Analysis indicates the site mimics legitimate career pages of multinational corporations, using cloned branding and fabricated job listings to deceive applicants into submitting sensitive data such as government identification numbers, banking details, and login credentials for professional networks. The phishing campaign appears targeted, with domain content dynamically tailored to match the victim's geographic location and industry preferences based on referrer data or browser metadata. Infrastructure analysis reveals multiple high-risk indicators. The domain resolves to IP address 91.195.240.94 and is flagged by 6 of 95 security vendors on VirusTotal as malicious. Registered through Name.com, Inc. on June 12, 2026, the domain exhibits a future creation date, a common tactic to evade reputation-based detection systems. The site appears on one security blocklist and uses an SSL certificate issued by DigiCert Inc, which, while legitimate, is frequently exploited by threat actors to lend false credibility to phishing pages. The combination of these factors—particularly the future registration date and the 6/95 detection ratio—strongly suggests deliberate malicious intent rather than a compromised legitimate site. Users who have visited delta-careers.com should immediately revoke any credentials entered on the site, particularly those used for professional networks, banking, or government services. Monitor financial accounts for unauthorized transactions and enable multi-factor authentication on all critical services. If personal identification documents were uploaded, contact relevant authorities to report potential identity theft. Organizations should block the domain and its resolving IP (91.195.240.94) at the network perimeter and update endpoint protection signatures to include this indicator of compromise. Security teams are advised to search logs for connections to the domain or IP to identify potentially compromised internal assets.