87405[.]com

This domain is currently under investigation for credential harvesting phishing activity targeting users of a legitimate writing platform. Analysis indicates the site was designed to mimic the interface of a well-known content creation service, likely to deceive visitors into submitting login credentials or personal information. The threat type is classified as generic_phishing with a focus on credential theft, though no active payloads or malware distribution have been confirmed at this stage. Infrastructure analysis reveals the domain 87405.com resolves to the IP address 198.74.52.13 and was registered through GoDaddy.com, LLC on February 13, 2008. The site employed a Let's Encrypt SSL certificate, which may have contributed to its perceived legitimacy. Detection metrics show 0 out of 95 security engines flagged the domain on VirusTotal, though it appears on three distinct security blocklists. Additional trust indicators include a Gridinsoft trust score of 0 out of 100, and the domain is actively blocked by MetaMask, PhishDestroy, and SEAL. The discrepancy between blocklist presence and low detection rates suggests either recent activation of the phishing infrastructure or evasion techniques targeting automated scanning systems. Mitigation for credential harvesting phishing threats involves immediate verification of domain authenticity before entering sensitive information. Users should cross-reference the URL with the official service domain and inspect SSL certificate details for inconsistencies. Network-level protections, such as DNS filtering or endpoint detection rules, should be configured to block access to domains with low trust scores or those appearing on multiple phishing blocklists. Administrators are advised to monitor for unauthorized access attempts originating from credentials potentially compromised through this domain, particularly if the legitimate service it mimics was accessed by users during the period it was active.