h1[.]spendex[.]click

This domain, h1.spendex.click, is identified as a credential harvesting phishing site designed to capture sensitive user login credentials. Analysis indicates no association with legitimate brands or known phishing kits, suggesting a custom or low-sophistication campaign. The infrastructure lacks SSL encryption, increasing the risk of data interception during transmission. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 17 out of 95 security vendors on VirusTotal, registered through Sav.com, LLC on August 30, 2025, and resolves to the IP address 178.16.53.103, hosted under AS202412 Omegatech LTD in the Netherlands. Google Safe Browsing explicitly classifies the domain as phishing, and it appears on one security blocklist. The page title, 'Site is created successfully!', is a common placeholder used in newly deployed phishing infrastructure. The domain is currently offline, likely due to takedown actions or abandonment by the threat actor. However, residual risk remains due to the recent registration date and the potential for the infrastructure to be reactivated or repurposed. Users who may have interacted with the domain are advised to reset credentials for any accounts accessed during the exposure window. Organizations should monitor for related indicators of compromise, including the IP address and registrar details, to prevent further exploitation.