infosec[.]wishyoudidntclickthis[.]com

This domain is flagged as a fake login phishing site designed to harvest credentials by impersonating legitimate security or authentication portals. Visitors are presented with a fraudulent login interface mimicking trusted platforms, likely targeting professionals or users seeking cybersecurity resources. The goal is to trick victims into entering sensitive information, such as usernames, passwords, or multi-factor authentication codes, which are then exfiltrated to attacker-controlled infrastructure. Analysis indicates the domain was registered on March 28, 2026, through Amazon Registrar, Inc., and resolves to the IP address 52.18.138.247. At the time of assessment, VirusTotal reported 0 detections out of 95 security engines, suggesting the threat is either new or evasive. The domain appears on one security blocklist and uses an SSL certificate issued by Amazon, which aligns with common phishing tactics leveraging cloud infrastructure to appear legitimate. The subdomain 'infosec' further reinforces the deception by masquerading as a cybersecurity-related resource. If you visited infosec.wishyoudidntclickthis.com or entered credentials on the site, immediate action is required. First, reset passwords for any accounts accessed or entered on the domain, prioritizing email, financial, and work-related platforms. Enable multi-factor authentication if not already active, using app-based or hardware tokens instead of SMS. Monitor accounts for unauthorized activity, such as logins from unfamiliar locations or devices. Additionally, check connected devices for malware, as phishing sites may distribute payloads or redirect to exploit kits. Report the incident to your organization's security team or a trusted cybersecurity professional for further analysis and containment.