user[.]cornerstonecapital[.]io

PhishDestroy identifies user.cornerstonecapital.io as a fraudulent domain actively engaged in brand impersonation targeting Cornerstone Capital users. This site masquerades as a legitimate Cornerstone Capital subdomain to deceive visitors into surrendering sensitive credentials or financial data. The domain resolves to IP 172.67.159.112 and leverages a Google Trust Services SSL certificate to appear authentic, exploiting the trust associated with the financial brand. Security teams should treat this as a high-priority threat due to its active status and potential for immediate credential theft or financial fraud. This domain demonstrates clear red flags across multiple indicators. VirusTotal analysis shows zero detections (0/95 engines), indicating it has evaded immediate detection despite active abuse. The domain was created on August 14, 2025—an extremely recent registration—via PDR Ltd. d/b/a PublicDomainRegistry.com, a common registrar for fraudulent domains. Without established reputation or historical data, its sudden appearance and lack of detection history should raise immediate suspicion. Users who have engaged with this domain should assume exposure of credentials or financial information and take immediate remediation steps. If you visited user.cornerstonecapital.io, assume your login credentials or financial data may have been compromised. Disconnect from the site immediately and revoke any passwords used on this domain across all accounts. Enable multi-factor authentication on your Cornerstone Capital account and monitor for unauthorized transactions. Report the domain to your security team and file a complaint with the Federal Trade Commission or local cybercrime unit. Consider running a malware scan on devices used to access this site to detect potential credential-stealing software.