on-notification-emessage[.]wasmer[.]app

The domain on-notification-emessage.wasmer.app has been identified as a high-risk phishing resource specifically designed to impersonate Navy Federal Credit Union, a financial institution. Analysis indicates this domain functioned as a fake login portal, targeting users with the intent of harvesting authentication credentials. As of the latest verification, the domain has been taken offline, though prior activity remains a documented threat. Technical indicators confirm the malicious nature of this infrastructure. The domain was flagged by 22 of 95 security vendors on VirusTotal, with additional detections from Google Safe Browsing classifying it as phishing. Infrastructure analysis reveals the domain resolved to the IPv6 address 2001:bc8:701:70a:d604:e6ff:fed8:fdc0, hosted on autonomous system AS12876 (Scaleway SAS) in France. Registration was facilitated through Wasmer, a platform often associated with ephemeral hosting of malicious domains. The page title mimicked the legitimate Navy Federal Credit Union branding, displaying 'Navy Federal Credit Union - Our Members are the Mission®' to enhance credibility. The domain appeared on at least one security blocklist and was proactively blocked by multiple threat intelligence feeds. Current status confirms the domain is offline, reducing immediate risk to end users. However, the infrastructure and tactics observed align with broader phishing campaigns targeting financial institutions. Organizations and individuals are advised to implement multi-factor authentication for all financial accounts, particularly those associated with credit unions or banks. Network administrators should update blocklists to include this domain and its associated IP address, while end users should verify the authenticity of any login portal by cross-referencing the URL with official sources. Continuous monitoring of similar domains registered through Wasmer or hosted on AS12876 is recommended to preemptively identify emerging threats.