cempls[.]org

Analysis of cempls.org shows a high‑risk credential‑phishing infrastructure that remains active as of July 12 2026. The domain was registered on 26 October 2024 through TuringSign Inc. d/b/a Cosmotown and resolves to IP 163.61.188.7, an address geolocated to the United States and associated with MIT. The site serves content over HTTPS using a Let’s Encrypt certificate (YR1) and returns HTTP 200 with a page title of “Home”. Detected server technologies include PHP, Bootstrap, LiteSpeed, and HTTP/3. Threat intelligence indicates the site is classified as generic credential phishing, is blocked by PhishDestroy, and appears on one external security blocklist. VirusTotal scanning reports a single positive detection out of 91 vendors, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. Nameservers are hosted on lytehosting.com (dns1‑dns4). While the exact phishing lure and target audience have not been publicly disclosed, the combination of a low trust score, positive vendor flag, and active blocklist status suggests the domain is being used to harvest credentials. Defenders should continue to block cempls.org at perimeter controls, monitor DNS queries for the associated nameservers, and consider adding the IP address 163.61.188.7 to threat‑intel feeds. Ongoing observation is advised to detect any changes in hosting or content that could affect the threat posture.