compliance-salesforce[.]com

The domain compliance-salesforce.com has been identified as a credential theft infrastructure specifically designed to impersonate Salesforce login portals. Currently, this domain is offline, though prior activity suggests it was actively harvesting user credentials through deceptive login interfaces. Analysis indicates this was not a generic phishing attempt but a targeted effort to compromise enterprise accounts by mimicking a trusted CRM platform. Infrastructure analysis reveals the domain was registered on November 06, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious registrations. It resolved to the IP address 178.16.54.185, hosted on AS202412 (Omegatech LTD) in the Netherlands. The domain was flagged by 10 of 95 security vendors on VirusTotal, appearing on at least one security blocklist. Notably, the site presented a default Plesk Obsidian 18.0.74 page title, suggesting either misconfigured or intentionally obfuscated hosting infrastructure. No SSL certificate was detected, further reducing the legitimacy of the domain. Current status indicates the domain has been taken offline, likely due to detection and mitigation efforts. However, the infrastructure remains a potential risk for re-emergence under similar or altered domains. Organizations are advised to block the domain and IP address at the network level, monitor for related indicators of compromise, and educate users on recognizing credential theft attempts. Security teams should review logs for any prior connections to 178.16.54.185 or the domain compliance-salesforce.com, particularly from enterprise environments where Salesforce credentials may have been exposed.