allengreentransportation[.]com[.]midwayhealthinc[.]com

This domain, www.allengreentransportation.com.midwayhealthinc.com, is identified as a credential theft domain, specifically designed to harvest login credentials and sensitive personal information through brand impersonation. The threat is currently active and classified as high risk, with the page title displaying 'AllenGreen Transportation | Chicago's Premier School & Corporate Transit' to lend an air of legitimacy.

Infrastructure analysis reveals the domain was created on February 13, 2026, and resolves to IP address 163.61.188.7. It is registered through TuringSign Inc. d/b/a Cosmotown and uses a Let's Encrypt SSL certificate. Security telemetry indicates the domain is flagged by 2 of 95 VirusTotal vendors, appears on 1 security blocklist (PhishDestroy), and holds a Gridinsoft trust score of 0/100. These indicators collectively confirm a high-risk profile consistent with phishing infrastructure targeting transportation or corporate service users.

The domain remains active and accessible, posing an ongoing threat to potential victims. Immediate action is recommended: block all traffic to this domain at the network level, educate users to avoid entering credentials on the site, and report the domain to relevant threat intelligence platforms for takedown. Regular monitoring for related domains or IP changes is advised to prevent lateral movement by threat actors.