welnom[.]com

PhishDestroy identifies welnom.com as an active credential theft domain associated with a generic phishing campaign. The site poses as a legitimate service to trick users into submitting sensitive login information. The domain was registered on April 14, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to IP address 188.114.96.3. Security vendors report a low but concerning detection rate, with 2 out of 95 flagging the domain as malicious. This domain leverages a recently issued Let's Encrypt SSL certificate to appear trustworthy, despite being operational for only a short time. The quick creation-to-activity timeline suggests opportunistic deployment, likely targeting users who may not scrutinize newly registered domains. While detection coverage is not yet widespread, the combination of fresh registration, low vendor flags, and active hosting indicates elevated risk for unsuspecting visitors. Users who accessed this domain should immediately review accounts for unauthorized activity and change passwords if credentials were entered. Avoid clicking links or downloading files from this site. System administrators are advised to block welnom.com at the network perimeter and inspect DNS logs for prior resolutions. Report any suspicious interactions to your security team. Remain vigilant for similar domains mimicking trusted services.