usdefencemilitaryportal[.]com

The domain usdefencemilitaryportal.com has been identified as a potential credential theft risk. This domain appears to be part of a phishing campaign designed to steal sensitive information from users, particularly targeting those associated with military or defense sectors. The campaign leverages social engineering techniques to trick victims into providing their login credentials and other sensitive data.

Infrastructure analysis reveals that the domain has a VirusTotal detection score of 3/95, suggesting that while a minority of security vendors recognize the threat, it remains undetected by many. The domain is registered through Fewmoretaps OU d/b/a Trustname.com and resolves to the IP address 89.117.51.233. It was created on April 24, 2026, and currently holds an SSL certificate issued by Let's Encrypt. The domain appears on one security blocklist and is flagged by PhishDestroy. The technologies detected on the domain include Tailwind CSS, Apache HTTP Server, Alpine.js, and jsDelivr, indicating a modern web infrastructure designed to appear legitimate.

As of the latest assessment, usdefencemilitaryportal.com has been taken offline, reducing the immediate risk to potential victims. However, the domain's brief online presence and the fact that it was flagged by some security vendors suggest that it may have been used in active phishing operations. Users are advised to avoid interacting with this domain and to report any related phishing attempts to their security teams. Despite the domain being offline, the risk of residual threat, such as previously harvested credentials, remains elevated.