3658e102.cc: Confirmed Phishing Site

Analysis on 3658e102.cc as of 21 July 2026 indicates that the domain is actively being used for phishing. The domain was registered on 3 May 2026 through Dynadot Inc and is served over HTTPS using a Let’s Encrypt R12 certificate, which does not provide any inherent trust. DNS resolution points to the single IPv4 address 40.81.18.27; the hosting provider is not identified in the available data. Nameservers ns1.1233dns.com and ns2.951dns.com are associated with the domain, a pattern frequently observed in malicious campaigns. VirusTotal has recorded 13 detections out of 95 scanned security vendors, confirming that multiple independent scanners flag the site as malicious. The domain is currently listed on one public security blocklist and has been explicitly blocked by PhishDestroy, reinforcing the high risk assessment. No public Safe Browsing, Open Threat Exchange, or page‑title information is available at this time, leaving the exact content of the landing page unverified. Defenders should add 3658e102.cc to internal URL filtering, blocklist the resolved IP address 40.81.18.27, and enforce TLS inspection to capture any credential submission. Email gateways should treat any messages containing this domain as malicious and quarantine them. Continuous monitoring of the associated nameservers and the IP for changes is recommended, as the infrastructure could be repurposed for additional campaigns. Organizations that rely on the affected brand should educate users about unsolicited requests that reference the domain, despite the lack of visual evidence. The combination of recent creation, active SSL, multiple vendor detections, and blocklist presence justifies a high‑severity response.