www-spendesk[.]co[.]com

Analysis of the domain www-spendesk.co.com indicates a high-risk credential phishing operation targeting users of the Spendesk financial management platform. The domain, created on August 16, 1997, is registered through Moniker Online Services LLC and currently resolves to IP address 104.21.76.26, hosted under AS13335 (Cloudflare, Inc.) in the United States. Infrastructure analysis reveals the absence of an SSL certificate, a critical security gap for a site purporting to handle login credentials. The page title, 'Spendesk | Spendesk login | All-in-One Spend Management Platform | Join Spendesk,' explicitly mimics the branding and login flow of the legitimate Spendesk platform, aligning with the credential phishing classification.

Security vendor detections are notable: 11 of 95 engines on VirusTotal flagged the domain as malicious. The domain appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, further corroborating its malicious classification. Nameservers are configured as ns1.nic.co.com, ns2.nic.co.com, ns3.nic.co.com, and ns4.nic.co.com, a pattern consistent with domains leveraging the .co.com namespace for phishing campaigns. At the time of this report, the domain has been taken offline, though historical resolution and detection data remain actionable for defenders.

Defenders are advised to block the domain and its associated IP (104.21.76.26) at the network level, update endpoint protection signatures, and monitor for credential reuse attempts from users who may have interacted with the site prior to its takedown. The registration age (nearly three decades) does not confer legitimacy, as the domain was likely repurposed for malicious activity. No evidence of a phishing kit or additional infrastructure (e.g., redirects, C2 servers) is present in the available data, but the alignment of the page title with a financial platform login portal is sufficient to classify this as a targeted credential harvesting attempt.