salesforce[.]tumee[.]com

This domain, salesforce.tumee.com, is identified as a generic phishing resource designed to impersonate the legitimate Salesforce authentication portal. The page title, Anmelden | Salesforce, directly mimics the branding and language used by Salesforce for user logins, suggesting an intent to harvest credentials from unsuspecting users. No evidence of a drainer kit or secondary payload delivery was observed in initial analysis, though the domain’s structure and content align with credential theft campaigns targeting enterprise users. Infrastructure analysis reveals the domain was registered on September 9, 2007, through NameCheap, Inc., a registrar frequently associated with both legitimate and malicious registrations. The domain resolves to the IPv6 address 2606:4700::6812:943, hosted under AS13335 (Cloudflare, Inc.), a network commonly used to obfuscate origin servers. At the time of assessment, VirusTotal reported 18 out of 95 security vendors flagging the domain as malicious. The domain appears on two independent security blocklists, including PhishDestroy and PhishingDB, and lacks an SSL certificate, further reducing its legitimacy. No Google Safe Browsing (GSB) detection was explicitly noted, though the absence of encryption and blocklist presence elevate its risk profile. The domain is currently offline, likely following detection and takedown efforts. However, residual risk persists due to the domain’s historical registration and potential for reactivation under the same or similar infrastructure. Users who accessed the domain prior to its deactivation may remain vulnerable to credential compromise. Organizations are advised to monitor for unauthorized access attempts linked to Salesforce accounts and enforce multi-factor authentication (MFA) to mitigate potential exposure. Continuous vigilance is recommended, as phishing domains often reappear under altered configurations or new registrations.