secure[.]367450[.]com

This domain, secure.367450.com, is identified as a credential phishing infrastructure designed to harvest user login credentials through fraudulent web pages. Analysis indicates no explicit brand impersonation or drainer kit association, though its technical configuration aligns with typical phishing campaigns. The domain operates under a Let's Encrypt SSL certificate, a common tactic to lend superficial legitimacy to malicious sites while evading basic security warnings. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 13.210.89.195 and was registered on January 12, 2017, through MarkMonitor, Inc. It is flagged by 14 out of 95 security vendors on VirusTotal, appears on one security blocklist, and was actively blocked by PhishDestroy. The domain’s creation date predates modern phishing trends, suggesting potential repurposing of older infrastructure for malicious use. No Google Safe Browsing (GSB) detections were recorded at the time of analysis, though this may reflect delayed reporting rather than absence of risk. As of the latest assessment, secure.367450.com is offline, reducing immediate exposure to end users. However, the elevated risk level persists due to residual threats, including potential reactivation of the domain or reuse of its associated IP for future campaigns. Organizations are advised to monitor network logs for connections to 13.210.89.195 and implement DNS-level blocking for secure.367450.com. Users should verify SSL certificates independently and report any suspicious login prompts to security teams. The domain’s registration with a major registrar and use of a widely trusted certificate authority underscore the need for layered defensive measures beyond basic URL filtering.