log-in[.]app

This domain, log-in.app, is actively engaged in credential harvesting phishing campaigns designed to deceive users into submitting sensitive login credentials. Analysis indicates the domain mimics legitimate authentication portals, leveraging social engineering tactics to trick victims into entering usernames, passwords, and potentially multi-factor authentication codes. The infrastructure is optimized for high-volume targeting, likely focusing on corporate, financial, or cloud service credentials, given the generic yet convincing naming convention and SSL-secured connection. Infrastructure analysis reveals log-in.app was registered through Key-Systems LLC on June 17, 2026, an unusually forward-dated creation that may indicate an attempt to evade temporal detection heuristics. The domain resolves to the IP address 77.75.48.72, which has been flagged by 4 out of 95 security vendors on VirusTotal for malicious activity. Additionally, log-in.app appears on one security blocklist and is actively blocked by PhishDestroy. The domain employs a Let’s Encrypt SSL certificate (YR2), a common tactic among phishing operators to lend an air of legitimacy to fraudulent sites. Users who have visited log-in.app or entered credentials on the site should immediately revoke any submitted login details from the associated accounts. It is recommended to enable multi-factor authentication where available and monitor linked accounts for unauthorized access or transactions. Network administrators are advised to block the domain and its resolving IP, 77.75.48.72, at the perimeter level. Affected individuals should conduct a full security audit of their systems, including scanning for malware or unauthorized browser extensions that may have facilitated the phishing attempt. Given the domain’s active status and high-risk classification, continued vigilance is warranted.