illuminanceglobal[.]io

PhishDestroy has placed illuminanceglobal.io under active investigation after detecting zero-day phishing infrastructure masquerading as a login portal. The domain resolves to 57.128.97.88 and uses an SSL certificate labeled “Internet Widgits Pty Ltd,” a common red flag for hastily issued certificates used to lend false legitimacy to spoofed login pages. Security teams have observed the domain being promoted across multiple attack vectors, including fraudulent email campaigns and cloned customer-support pop-ups, with the intent of harvesting corporate and personal login credentials. Early telemetry indicates that once credentials are entered, they are immediately relayed to a remote server and then used in follow-on account-takeover attempts. This domain was flagged by PhishDestroy on receipt of IOC reports; VirusTotal currently shows 1 out of 95 scanners detecting the threat, underscoring the need for proactive blocking rather than reactive detection. WHOIS data reveals the domain was registered on March 3, 2026, through Namecheap Inc., a registrar frequently leveraged for bulletproof hosting of short-lived phishing domains. A cross-reference against PhishDestroy’s real-time blocklist indicates zero prior sightings, confirming this is a newly spun up operation designed to evade historical detection signatures. The combination of a single-day age, low detection coverage, and heavy use of HTTPS obfuscation makes illuminanceglobal.io particularly dangerous for users who rely solely on automated scanning. If you or anyone in your organization has visited illuminanceglobal.io or entered any credentials, immediately rotate passwords on that service and enable multi-factor authentication where available. Isolate any device that may have been used to visit the site and perform a full antivirus scan. Block the domain at DNS level by adding 57.128.97.88 and the string “illuminanceglobal.io” to local firewall or proxy deny lists. Report the incident through your internal SOC channels and forward any suspicious emails or URLs to PhishDestroy for enrichment and takedown coordination. Continue monitoring external threat-intel feeds, as this domain may spawn new subdomains or slight variations as the campaign evolves.