www-firsthorlzen[.]top

This domain, www-firsthorlzen.top, is assessed at a high risk level and is specifically associated with credential theft phishing. The domain was created on December 14, 2025, and has been taken offline as of the latest assessment. Analysis indicates that the domain has been flagged by 19 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicious activity. The domain is registered through NiceNIC International Group Co., Limited and resolves to the IP address 144.31.244.50, which is located in Germany (DE) and is part of the AS213877 U1 DIGITAL SERVICES LTD network. The domain appears on five security blocklists, including PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB, further confirming its malicious nature. The SSL certificate used by the domain is of type R13, which may have been used to gain user trust by mimicking legitimate HTTPS connections.

To mitigate the risks associated with credential theft phishing from this domain, organizations and individuals are advised to implement several security measures. First, ensure that all users are trained to recognize phishing attempts, particularly those that involve login pages. This includes verifying the URL and SSL certificate of any login page before entering credentials. Second, deploy multi-factor authentication (MFA) for all critical accounts to add an additional layer of security. Third, regularly update and patch all systems and applications to protect against known vulnerabilities that could be exploited by phishing attacks. Finally, consider using security tools and services that can detect and block access to known malicious domains, such as those listed on security blocklists.