dl[.]securefiledrives[.]com

The domain dl.securefiledrives.com is currently active and has been identified as a credential phishing vector. Registration data shows the domain was created on August 31, 2016 and was registered through MarkMonitor, Inc., a registrar commonly associated with legitimate brand protection services. DNS resolution points to the IPv4 address 3.104.102.7, and the domain is served by four Amazon Route 53 name servers (ns-1512.awsdns-61.org, ns-1868.awsdns-41.co.uk, ns-424.awsdns-53.com, ns-993.awsdns). No additional infrastructure details have been disclosed, and the specific phishing landing page content has not been publicly analyzed. The threat classification is credential_phishing, and the risk level is marked as under_investigation. Because the domain resolves to a public IP and uses generic cloud‑based name servers, it is likely leveraging shared hosting resources to host malicious content. Defenders should block outbound connections to 3.104.102.7 and add dl.securefiledrives.com to URL filtering lists. Continuous monitoring of DNS queries for this domain and related subdomains is advised, as is periodic re‑evaluation of the domain’s activity status. Organizations should educate users about unsolicited credential requests and enforce multi‑factor authentication to mitigate potential credential compromise.