hcxr-42552[.]wasmer[.]app

The domain hcxr-42552.wasmer.app has been identified as a credential theft operation specifically targeting Navy Federal Credit Union members. Analysis confirms the site impersonates the legitimate financial institution, presenting an authentic-looking login interface to harvest sensitive account credentials. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Technical indicators reveal the domain was flagged by 25 of 95 security vendors on VirusTotal, a notably high detection rate for credential theft infrastructure. Infrastructure analysis shows the domain resolved to the IP address 62.210.172.162, which appears on at least one security blocklist. Registration details indicate the domain was provisioned through Squarespace Domains II LLC, a registrar commonly observed in phishing campaigns due to its accessibility. Google Safe Browsing further classified the domain as malicious, reinforcing the credential theft classification. No legitimate association with Navy Federal Credit Union or its authorized partners was found. While the domain is currently offline, affected users should immediately reset credentials for any accounts accessed through this interface, particularly those tied to financial services. Organizations are advised to block the IP address 62.210.172.162 at the network perimeter and monitor for related indicators of compromise. Users should verify domain authenticity before entering credentials, prioritizing direct navigation to known legitimate URLs rather than following links from emails or messages. Security teams are encouraged to review logs for connections to the identified IP and domain to assess potential exposure.