joserrago[.]789greeting[.]com

This domain is flagged as an elevated-risk credential harvesting phishing site targeting enterprise users. Analysis indicates the infrastructure was specifically designed to mimic legitimate training or security awareness portals, as evidenced by the page title '404 - Quick Tip | Cofense,' which aligns with common security training platforms. The domain presents a direct threat to organizational security by attempting to capture login credentials through deceptive landing pages. Infrastructure analysis reveals the domain joserrago.789greeting.com was registered through MarkMonitor Inc. on June 15, 2026, and resolves to the IP address 34.194.247.17. The site employs a Let's Encrypt SSL certificate and implements HTTP Strict Transport Security (HSTS), which may lend an appearance of legitimacy. Detection metrics show 16 out of 95 security vendors on VirusTotal have flagged the domain, while it appears on one security blocklist. The domain was subsequently taken offline, though residual risk remains for systems that may have cached or interacted with the site prior to its removal. Mitigation for this credential harvesting threat requires immediate action from network administrators and end-users. Organizations should block the domain and IP at the perimeter, revoke any cached SSL certificates associated with the domain, and conduct a review of network logs for connections to 34.194.247.17. End-users who accessed the site should reset credentials for any accounts entered, particularly those associated with enterprise systems. Security teams are advised to monitor for similar domains registered through MarkMonitor Inc. with recent creation dates, as this registrar and timeline align with observed phishing campaign patterns.