pasmaahatfe[.]com

pasmaahatfe.com has been identified by PhishDestroy as an active credential-harvesting site designed to trick users into surrendering usernames and passwords. The page mimics legitimate login portals and is currently live on the public web, hosted at the IPv4 address 92.113.16.171. Early analysis shows the threat actors behind this domain are distributing links through spam campaigns and spoofed emails, aiming to capture valid credentials that may be reused across other services. Users who enter any information risk immediate account takeover and potential financial loss.

PhishDestroy’s investigation confirms this domain is only 24 days old—registered on March 18, 2026—through Hostinger operations, UAB, under a freshly issued Let’s Encrypt certificate. As of the latest scan, the site shows 0 detections out of 95 engines on VirusTotal, meaning traditional antivirus defenses have not yet caught up. The combination of a recently registered domain, low detection count, and active hosting suggests a fast-moving campaign that can evade standard filters. Technical indicators such as the IP address 92.113.16.171 and the SSL certificate remain consistent across the active phishing pages, confirming infrastructure reuse typical of low-cost phishing kits.

If you visited pasmaahatfe.com—especially if you entered any login credentials—immediately change the password on every important account that shares that email or username. Enable multi-factor authentication wherever possible and scan your device for malware in case the page dropped a keylogger or session cookie. Report the domain to your email provider or local cybercrime unit and avoid clicking any future links from unknown senders. For organizations, consider blocking the IP 92.113.16.171 and the domain at your network perimeter to prevent further exposure.