ww25[.]bergev[.]org

This domain, ww25.bergev.org, is flagged as an active credential harvesting phishing site targeting users through deceptive login portals. Analysis indicates a high-risk classification due to its infrastructure and detection metrics, suggesting an intent to capture sensitive authentication details such as usernames, passwords, and potentially multi-factor authentication codes. The threat type aligns with generic phishing but exhibits characteristics of targeted credential theft, likely impersonating legitimate services to exploit user trust. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain is registered through MOBIKAPP Limited, a registrar frequently associated with high-risk domains, and was created on March 26, 2025, indicating recent deployment for malicious purposes. It currently resolves to the IP address 199.59.243.228, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain lacks an SSL certificate, a critical red flag for phishing sites, and is flagged by 4 out of 95 security vendors on VirusTotal. Additionally, it appears on one security blocklist, further corroborating its malicious status. The page title, bergev.org, suggests an attempt to mimic or spoof a legitimate domain, a common tactic in credential harvesting campaigns. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP address across all network security controls. Organizations should deploy email filtering rules to quarantine messages containing links to ww25.bergev.org or its resolved IP. End-users should be educated on recognizing phishing indicators, such as the absence of HTTPS, misspelled domains, and unsolicited login requests. Security teams are advised to monitor for credential reuse attempts, particularly if the domain impersonates a known service. Given the domain's recent creation and active status, proactive threat hunting for related infrastructure or similarly named domains is recommended to preempt further compromise attempts.