mysimerp[.]net

mysimerp.net was observed delivering a generic phishing campaign targeting employees of medical expense reimbursement providers. The site presents a fabricated page titled “GET A (SIMERP) Self Insured Medical Expense Reimbursement Plan – Saves Hundreds In FICA and Workman's Comp At ZERO Net Cost To You!” that mimics legitimate benefit‑enrollment portals. The page returns HTTP 200 and hosts a Let's Encrypt certificate, indicating active web service.

Technical analysis shows the domain resolves to 75.98.162.139, an address owned by AS55293 A2 Hosting, Inc. in the United States. The registration was performed through GoDaddy.com, LLC on January 19 2024, and the authoritative nameservers are ns1909215924.a2dns.com and ns7598162139.a2dns.com. Gridinsoft assigns a trust score of 0/100, and the domain appears on one public security blocklist.

VirusTotal flagged the domain in 12 of 95 scanned security vendors, confirming malicious behavior. AlienVault OTX references the domain in five separate threat pulses, and PhishDestroy has already blocked it. These independent sources corroborate the phishing intent and indicate ongoing distribution.

While the current page content is limited to the deceptive enrollment claim, the underlying intent is to harvest credentials or personal data from visitors. No additional malware payloads have been observed, but the presence of a valid TLS certificate may lend credibility to the lure. Uncertainty remains regarding any secondary command‑and‑control infrastructure that could be leveraged after credential capture.

Defenders should block DNS resolution to 75.98.162.139 and add mysimerp.net to web filtering and URL reputation lists. Email gateways must inspect inbound messages for references to “SIMERP” or the exact page title and quarantine suspicious links. Continuous monitoring of related IOCs, including the two nameservers and the associated IP, is recommended to detect potential re‑hosting attempts.