lm1hvy6s40[.]accutaneforacne[.]com

This domain, lm1hvy6s40.accutaneforacne.com, is flagged as an elevated-risk credential harvesting phishing site. Analysis indicates it operates under the guise of a document-sharing service, presenting a 'Shared Document' page title to deceive users into submitting login credentials. The threat type aligns with generic phishing but exhibits targeted characteristics, likely aimed at corporate or academic environments where document collaboration is common. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain was registered on May 05, 2026, through Key-Systems GmbH, a registrar frequently associated with malicious domain registrations. It resolves to the IP address 104.21.94.8, hosted on AS13335 (Cloudflare, Inc.), a network often exploited for phishing due to its content delivery and obfuscation capabilities. The SSL certificate is issued by Let's Encrypt (serial number E8), a legitimate but commonly abused certificate authority for phishing sites. Detection metrics further validate the threat: 18 out of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on at least one security blocklist, specifically PhishDestroy. The domain's current offline status suggests takedown action, though historical activity remains a risk for retrospective analysis. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP (104.21.94.8) at the network perimeter. Organizations should deploy email filtering rules to quarantine messages containing links to the domain or its subdomains. End-user education should emphasize verifying document-sharing links, particularly those with unusual subdomains or mismatched branding. Security teams are advised to monitor for credential reuse attempts, as harvested data may be leveraged in subsequent attacks. Given the domain's registration date (May 2026), future campaigns may reuse the infrastructure; proactive monitoring of newly registered domains under the same registrar (Key-Systems GmbH) is recommended. Incident responders should preserve logs of any interactions with the domain for forensic analysis.