like[.]userdesk-en[.]com

This domain, like.userdesk-en.com, is identified as a credential harvesting phishing site targeting users through deceptive login portals. Analysis indicates the domain is currently offline, though it previously hosted content designed to impersonate legitimate services for the purpose of stealing authentication credentials. No specific brand impersonation has been confirmed, but the infrastructure aligns with generic phishing campaigns aimed at broad credential theft. Infrastructure analysis reveals the domain was flagged by 18 of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious nature. It was registered through Tucows Domains Inc. on February 21, 2026, and resolved to the IP address 64.29.17.65, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). The domain appears on two security blocklists, and its SSL certificate was issued by Let's Encrypt (R13). The page title captured during analysis was '404: NOT_FOUND,' suggesting either a takedown or temporary suspension of the phishing content. Current status confirms the domain is offline, though residual risk remains due to potential re-activation or migration to alternative infrastructure. Organizations are advised to block the domain and its associated IP address (64.29.17.65) at the network perimeter. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range. End-users should be educated on recognizing phishing attempts, particularly those involving unsolicited login prompts or generic credential harvesting pages. If credentials were entered on this domain, immediate password resets and multi-factor authentication enforcement are recommended.