poshmark[.]my-order-id37284[.]icu

Analysis of poshmark.my-order-id37284.icu confirms its classification as a credential phishing domain targeting Poshmark users. The domain was registered on December 11, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to IP 104.21.48.108, hosted on Cloudflare's network (AS13335). No SSL certificate is present, increasing exposure to interception risks. The page title, 'Captcha verification,' suggests an attempt to mimic legitimate authentication flows, a common tactic in credential harvesting schemes.

As of July 22, 2026, the domain appears on one security blocklist and is flagged by PhishDestroy. VirusTotal reports detection by 3 of 95 security vendors, indicating partial but not universal recognition of the threat. The domain's trust score from Gridinsoft is 0/100, reflecting high-risk indicators. Nameservers ajay.ns.cloudflare.com and uma.ns.cloudflare.com further link the domain to Cloudflare infrastructure, which is frequently leveraged by threat actors to obscure hosting origins.

The domain is currently offline, though this status may change. Defenders should treat this domain as malicious and prioritize blocking it at DNS, proxy, and endpoint layers. Monitoring for related domains using similar naming patterns (e.g., 'my-order-id' followed by numeric sequences) is recommended to preemptively disrupt potential follow-up campaigns. The exact content of the phishing page is not yet analyzed, but the combination of Poshmark branding in the domain, absence of SSL, and 'Captcha verification' page title strongly indicates a credential theft operation.