30p[.]faf[.]mytemp[.]website

This domain, 30p.faf.mytemp.website, is flagged as a fake login portal designed to harvest user credentials. Analysis indicates the site mimics legitimate authentication pages to deceive targets into submitting sensitive information. The domain is currently offline, though prior activity suggests it was operational for credential theft campaigns. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on January 05, 2024, and resolves to the IP address 92.205.251.195. It holds a Gridinsoft trust score of 0/100 and a Scamadviser trust score of 1/100, reflecting negligible legitimacy. The domain appears on one security blocklist and is flagged by 8 of 95 security vendors on VirusTotal. The SSL certificate is issued by Starfield Technologies, Inc., and the page title returned a 403 Forbidden error, indicating restricted access or prior takedown. Current status confirms the domain is offline, though residual risk remains due to its recent registration and prior malicious activity. Organizations are advised to block the domain and associated IP (92.205.251.195) at the perimeter. Security teams should monitor for credential reuse attempts from affected users and conduct retrospective log analysis for connections to 30p.faf.mytemp.website or its resolved IP. If the domain reappears, immediate containment measures should be enforced, including DNS sinkholing and endpoint isolation for any systems that interacted with it.