hotwinresmi-com[.]ipns[.]dweb[.]link

This domain is flagged as an elevated-risk generic phishing threat targeting users of the Hotwin platform. Analysis indicates the infrastructure was designed to mimic legitimate Hotwin login portals, likely to harvest user credentials through deceptive input forms. The threat type aligns with credential theft, a common objective in phishing campaigns where victims are tricked into entering sensitive information on fraudulent pages. Infrastructure analysis reveals the domain hotwinresmi-com.ipns.dweb.link was registered through CSC Corporate Domains, Inc. on February 24, 2017, and resolves to the IP address 209.94.90.2, hosted on AS40680 (Protocol Labs) in the United States. The SSL certificate is issued by Let's Encrypt (serial number E7). At the time of detection, 15 out of 95 security vendors on VirusTotal flagged this domain as malicious. It appears on two security blocklists and is explicitly blocked by PhishDestroy and PhishingDB. The page title observed was /ipns/hotwinresmi.com/, further suggesting an attempt to impersonate the legitimate Hotwin domain. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (209.94.90.2) at the network perimeter. Organizations should deploy email and web filtering rules to prevent users from accessing or receiving communications linked to this domain. Endpoint protection systems should be updated to detect and quarantine any artifacts associated with this campaign, including scripts or payloads hosted on the domain. User awareness training should emphasize the risks of credential theft, particularly through fake login portals, and encourage verification of domain authenticity before entering sensitive information. Monitoring for similar domains registered through the same registrar or resolving to the same IP range may help identify related threats.