parttime-harley[.]lol

PhishDestroy identifies www.parttime-harley.lol as a credential theft domain leveraging a generic lure crafted for Harley-Davidson enthusiasts seeking part-time work. The site mimics a community job board to harvest user credentials, likely targeting forum members or brand followers. No specific drainer kit fingerprint is publicly documented, but behavioral analysis indicates a classic credential harvesting workflow designed to siphon login details for further exploitation. This domain resolves to IP 8.222.213.135 and was registered on April 13, 2026 through Dynadot LLC. VirusTotal shows detection by 6 out of 95 security vendors, with a Let’s Encrypt SSL certificate issued to mask malicious intent. At the time of analysis, the domain remains unlisted in Google Safe Browsing and has not been widely added to public blocklists, suggesting recent activation and limited exposure in global feeds. The campaign is currently active and poses an elevated risk due to low blocklist coverage and the use of a trusted SSL certificate. Users accessing this domain risk direct credential compromise and potential follow-on attacks including account takeover and financial fraud. Immediate network-level blocking is recommended, alongside user awareness alerts regarding suspicious job offers on Harley-Davidson branded platforms. Remaining risk is high until global blocklists and browser defenses are updated.