desks90[.]one

The domain desks90.one was identified as a credential harvesting phishing site targeting users through deceptive service interfaces. Currently offline, this infrastructure previously presented itself under the page title 'Service Area,' a common tactic used to mimic legitimate customer support or account management portals. Analysis indicates the domain was designed to harvest login credentials, financial details, or other sensitive information through fraudulent input forms. Infrastructure analysis reveals the domain was registered through Spaceship, Inc. on May 24, 2026, an unusually future-dated registration that may indicate an attempt to evade time-based detection mechanisms. It resolved to the IP address 188.114.96.3, a Cloudflare-hosted endpoint leveraging HTTP/3 and Cloudflare Browser Insights for performance and analytics tracking. The domain was flagged by 5 of 95 security vendors on VirusTotal, appeared on one security blocklist, and received a trust score of 0 out of 100 from Gridinsoft. Additional indicators include the use of Cloudflare’s infrastructure, which is frequently abused to obscure the origin of malicious traffic and bypass basic security filters. Although desks90.one is currently offline, the domain remains a credible threat due to its recent activity and the persistence of phishing infrastructure. Organizations should monitor for re-emergence under the same or similar domains, particularly those mimicking service portals or support pages. Network-level protections should be updated to block the IP address 188.114.96.3 and any associated hostnames. Security teams are advised to review logs for connections to this domain or IP during its active period and to implement multi-factor authentication as a mitigation against credential theft. Future registrations from the same registrar or using identical infrastructure patterns should be treated with heightened scrutiny.