evil-corp[.]app

This domain is flagged as an active credential harvesting phishing site designed to mimic legitimate authentication portals. Analysis indicates the infrastructure is specifically engineered to capture usernames, passwords, and session tokens through fraudulent login interfaces, posing a direct risk to user account security and organizational data integrity. Infrastructure analysis reveals concrete evidence supporting the classification: the domain evil-corp.app was registered on June 27, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with malicious registrations. It currently resolves to IP address 104.21.53.249 and presents a page titled 'EvilCorp,' a clear indicator of intent to deceive. Security engines have detected the threat, with 1 out of 95 vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears in one AlienVault OTX threat intelligence pulse, further corroborating its association with phishing campaigns. Users who have visited evil-corp.app or entered credentials on the site should immediately revoke any active sessions and change passwords for all accounts that may have been exposed. Enable multi-factor authentication where available to mitigate unauthorized access. Organizations should block the domain and its resolving IP at the network perimeter and monitor for anomalous authentication attempts. If financial or sensitive data was submitted, affected parties should report the incident to relevant authorities and consider credit monitoring services to detect potential misuse.