login[.]itpatches[.]com

This domain, login.itpatches.com, operates as a credential phishing infrastructure designed to deceive users into submitting corporate or enterprise login credentials. Analysis indicates the site mimics legitimate authentication portals, likely targeting employees or contractors under the guise of a trusted service. The presence of HSTS headers suggests an attempt to appear secure while facilitating unauthorized data collection, a common tactic in credential harvesting campaigns. Infrastructure analysis reveals multiple indicators of malicious intent. The domain was registered on March 31, 2026, through MarkMonitor Inc., a registrar frequently abused for phishing operations due to its association with high-profile brands. Security vendors on VirusTotal flagged the domain at a ratio of 13/95, indicating moderate but consistent detection across threat intelligence platforms. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB, and resolves to the IP address 52.204.246.179. The SSL certificate, issued by Let's Encrypt, further aligns with phishing tactics, as attackers often use valid certificates to bypass initial security warnings. Users who visited login.itpatches.com or entered credentials on the site should assume their login details have been compromised. Immediate action is required, including resetting passwords for all accounts where the same credentials may have been reused, particularly for corporate or sensitive services. Organizations should monitor for unauthorized access attempts and enable multi-factor authentication where possible. If the domain was accessed via a corporate device, IT security teams should conduct a forensic review to assess potential lateral movement or data exfiltration. The domain is currently offline, but similar infrastructure may re-emerge under different names, necessitating heightened vigilance for phishing attempts.