actividadinusual2026[.]fwh[.]is

This domain, actividadinusual2026.fwh.is, is actively engaged in credential theft operations targeting unsuspecting users. Analysis confirms the domain remains operational as of the latest verification, with no takedown or mitigation measures implemented. No specific brand impersonation has been identified, but the infrastructure is designed to harvest login credentials through deceptive landing pages and form submissions. Infrastructure analysis reveals the domain was registered on November 01, 2024, through FreeWebHostingArea, a provider frequently associated with low-cost or free hosting services. It resolves to the IP address 185.27.134.221, which has been flagged by 8 of 95 security vendors on VirusTotal for malicious activity. The SSL certificate is issued by ZeroSSL GmbH, a common provider for both legitimate and malicious domains, offering no inherent trust indicators. No additional blocklist entries or trust scores were identified beyond the VirusTotal detections, though this does not diminish the confirmed malicious intent. The domain remains active and poses a high risk to users who may encounter it through phishing emails, malicious advertisements, or compromised redirects. Organizations are advised to block both the domain and its resolving IP at the network perimeter. Endpoint protection systems should be updated to include actividadinusual2026.fwh.is in their deny lists, and users should be educated to recognize credential theft tactics, particularly those involving fake login prompts or urgent account verification requests. Monitoring for connections to 185.27.134.221 or related subdomains under fwh.is is recommended for retrospective threat hunting.