popstesco[.]wasmer[.]app

PhishDestroy identifies popstesco.wasmer.app as a high-risk credential theft phishing domain actively impersonating legitimate services to harvest user credentials. This domain employs social engineering tactics, leveraging deceptive domain names and trusted hosting infrastructure to deceive victims into entering sensitive login details. The threat is classified as high-risk due to its active status, widespread vendor detections, and alignment with documented phishing campaigns targeting credential harvesting. This domain exhibits multiple indicators of malicious intent. VirusTotal analysis reveals 22 out of 95 security vendors flagged this domain, while OpenPhish and PhishingArmy have independently added it to their blocklists. The domain resolves to IP address 62.210.172.151 and operates under a Let’s Encrypt SSL certificate, which may enhance its perceived legitimacy. Google Safe Browsing categorizes the domain under SOCIAL_ENGINEERING, a classification reserved for pages designed to deceive users into sharing confidential information. The infrastructure and detection profile strongly suggest this is part of a coordinated credential theft campaign. Organizations and users are advised to take immediate defensive measures. Block traffic to popstesco.wasmer.app at the network perimeter using the provided indicators. Update endpoint protection rules to include this domain and associated IP address (62.210.172.151) in blacklists. Educate users to verify URLs and avoid entering credentials on suspicious pages. Given the active nature of this threat and its detection across multiple security platforms, prioritize containment to prevent potential credential compromise and downstream attacks.