enoffmus-67whm4lhb9[.]edgeone[.]app

This domain, enoffmus-67whm4lhb9.edgeone.app, is confirmed to operate as a credential theft site designed to harvest user login credentials under the guise of a music promotion service. Analysis of the page title, 'ENOFFMUS — Music Promotion,' indicates an attempt to impersonate legitimate platforms in the music industry, likely targeting artists, producers, or industry professionals seeking promotional services. No direct association with known cryptocurrency drainer kits or brand-specific impersonation (e.g., Spotify, Apple Music) was observed, but the credential harvesting mechanism aligns with broader phishing tactics used to compromise user accounts for financial or data exploitation. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain is registered through MarkMonitor, Inc., and was created on March 01, 2026, an anomalous future date suggesting potential domain spoofing or registry manipulation. It resolves to the IP address 43.152.26.58, which has been linked to other low-reputation hosting environments. The domain is flagged by 2 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100, and appears on at least one security blocklist. The SSL certificate, issued by DigiCert, Inc., does not mitigate the risk, as phishing sites frequently leverage valid certificates to appear legitimate. Detection by PhishDestroy further corroborates its classification as a malicious endpoint. As of the latest assessment, the domain has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a latent threat, as the domain could be reactivated or repurposed for future campaigns. Users who interacted with the site are advised to reset credentials for any accounts accessed during the exposure window, particularly those associated with music platforms or financial services. Organizations should monitor network logs for connections to 43.152.26.58 and update blocklists to include this IP and domain. The elevated risk level persists due to the domain's registration under a reputable registrar, which may facilitate future abuse if not revoked.