media2[.]wasmer[.]app

This domain, media2.wasmer.app, is identified as a phishing site targeting Navy Federal Credit Union members. The page title, 'Navy Federal Credit Union - Our Members are the Mission®,' explicitly mimics the legitimate financial institution to deceive users into submitting sensitive credentials. No specific drainer kit signatures were observed in available telemetry, but the generic_phishing classification indicates a broad credential-harvesting campaign. The domain infrastructure aligns with common phishing patterns, including the use of free SSL certificates to lend false legitimacy to the fraudulent site. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to the IP address 5.161.23.223 and was registered through Squarespace Domains II LLC. Security vendor detections on VirusTotal stand at 5/95, with one confirmed appearance on a security blocklist. The SSL certificate is issued by Let's Encrypt, a common tactic to evade browser security warnings. Gridinsoft trust scoring assigns a 0/100 rating, further corroborating the malicious nature of the domain. No Google Safe Browsing (GSB) listing was observed at the time of analysis, though this may reflect detection latency rather than benign status. At present, media2.wasmer.app has been taken offline, likely in response to security vendor interventions. However, the elevated risk classification persists due to the domain's recent operational history and the potential for re-activation under alternative infrastructure. Users who may have interacted with this site are advised to immediately reset credentials for any financial or personal accounts accessed during the exposure window. Organizations should monitor for related phishing campaigns, particularly those leveraging Squarespace-registered domains or the 5.161.23.0/24 IP range, as these may indicate broader credential theft operations.