rightclick-105641verifyid754356[.]square[.]site

Analysis as of July 25, 2026 indicates that the domain rightclick-105641verifyid754356.square.site is linked to a credential‑phishing campaign. The domain was created on February 5, 2019 and is registered through MarkMonitor, Inc., a registrar commonly used for brand‑protected names, suggesting the operators deliberately leveraged a reputable registrar to increase perceived legitimacy. Technical inspection shows the site is hosted on Amazon Web Services and fronted by Cloudflare, with DNS delegated to four AWS name servers (ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, ns-810.awsdns). The resolved IP address, 74.115.51.5, belongs to AS27647 Weebly, Inc. in the United States, a hosting provider often used for short‑lived malicious pages.

The HTTPS certificate is issued by Let’s Encrypt (E7), a free certificate authority, which does not provide any intrinsic reputation signal. An HTTP request returns a 404 status and the sole visible page title is "Just a moment...", a generic Cloudflare challenge page that offers no insight into the malicious payload. VirusTotal records show that 13 of 95 scanned security vendors flagged the domain, indicating a non‑trivial detection rate across independent scanners. The domain appears on one public security blocklist and is actively blocked by the PhishDestroy service, confirming that at least one defensive organization has recognized it as malicious.

Current status is offline, meaning the site no longer serves content, but the infrastructure remains observable and could be re‑activated. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor the associated IP address for any future activity, and consider adding the domain to internal threat‑intel feeds. Further investigation is limited by the lack of captured page content; analysts should monitor for any re‑appearance of the site or related sub‑domains that may host credential‑phishing pages.