secure-inbox[.]app

PhishDestroy assesses secure-inbox.app at an elevated risk level due to its specific threat type: credential phishing. This domain was designed to trick users into entering sensitive login information, likely for email accounts, under the guise of a legitimate secure inbox service. The site has already been taken offline, but the infrastructure remains a concern.

Technical indicators paint a clear picture of malicious intent. VirusTotal reports that 4 out of 95 security vendors flag this domain, and it appears on three security blocklists. The domain resolves to IP address 46.101.205.204, registered through Name.com, Inc., and was created on June 15, 2026, a relatively recent date typical of phishing campaigns. Its SSL certificate is issued by Let's Encrypt (YE1), which is commonly abused by threat actors. Additionally, AlienVault OTX shows the domain is listed in two threat intelligence pulses, reinforcing its association with credential theft. The page title "SecureInbox" further indicates the phishing lure.

Users who may have encountered this site should immediately change their email passwords and enable multi-factor authentication on all accounts. If credentials were entered, they should also scan their devices for malware and monitor for suspicious account activity. PhishDestroy recommends reporting any such domains to security vendors and blocking the IP 46.101.205.204 at the network level. While the site is currently offline, similar domains may reappear, so vigilance is advised.