login-navyfederal[.]org[.]secure[.]us[.]q38[.]co

This domain, login-navyfederal.org.secure.us.q38.co, is actively engaged in credential phishing targeting users of Navy Federal Credit Union. The infrastructure presents a fraudulent login interface designed to harvest account credentials, including usernames, passwords, and potentially multi-factor authentication codes. Analysis of the domain structure and subdomain path suggests an attempt to mimic legitimate authentication portals, increasing the likelihood of successful deception among unsuspecting users. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered on September 16, 2025, through NameCheap, Inc., and currently resolves to the IP address 192.142.54.88, hosted in the Netherlands under AS214036 (Ultahost, Inc.). No SSL certificate is present, exposing transmitted data to interception. Security vendors have flagged the domain on VirusTotal, with 14 out of 95 engines detecting malicious activity. Additionally, the domain appears on two security blocklists and is explicitly blocked by PhishDestroy and PhishingDB. The page title, 'Index of /', further indicates misconfigured or intentionally obfuscated server content. Users who visited login-navyfederal.org.secure.us.q38.co should immediately assume their credentials were compromised. Affected individuals must change their Navy Federal account passwords and enable multi-factor authentication if not already active. Monitor the account for unauthorized transactions or configuration changes, such as altered contact details or linked external accounts. Financial institutions should be notified of potential fraud attempts, and users are advised to review connected devices for suspicious activity. If personal or financial data was entered, consider placing a fraud alert with credit bureaus to mitigate identity theft risks.