especially[.]wasmer[.]app

This domain, especially.wasmer.app, was identified as a credential theft operation targeting Navy Federal Credit Union members. Analysis indicates the site impersonated the financial institution’s branding, including the exact page title 'Navy Federal Credit Union - Our Members are the Mission®', to deceive victims into submitting login credentials. No evidence of a crypto drainer kit was observed, but the site’s infrastructure and content align with credential harvesting tactics commonly used in account takeover schemes. Infrastructure analysis reveals the domain was registered through Squarespace Domains II LLC and resolved to the IP address 62.210.172.162, hosted on AS12876 (Scaleway SAS) in France. At the time of detection, 21 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing explicitly classified it as phishing. The domain appeared on one security blocklist, and its SSL certificate was issued by Let’s Encrypt (identifier: YE2). No creation date was provided in available telemetry, but the rapid takedown suggests recent registration. The domain has since been taken offline, likely due to automated detection or hosting provider intervention. However, residual risk remains for users who may have interacted with the site prior to its removal. Organizations should monitor for unauthorized access attempts linked to credentials potentially harvested from this campaign. Network-level protections, such as DNS filtering or endpoint detection rules, should be updated to block residual indicators, including the resolved IP and associated SSL certificate thumbprint. Users should be advised to reset credentials if exposure is suspected, particularly for financial accounts.