powwowski[.]com

This domain, powwowski.com, has been identified as part of a credential harvesting phishing campaign targeting users through fraudulent login portals. The infrastructure is designed to mimic legitimate authentication interfaces, tricking visitors into submitting sensitive credentials such as usernames, passwords, and multi-factor authentication tokens. Analysis of the domain’s behavior and associated artifacts indicates a deliberate attempt to exfiltrate user data for unauthorized account access or financial fraud. The threat is classified as elevated due to its active distribution and the potential for significant impact on compromised individuals or organizations. Evidence supporting this classification includes detection by 18 out of 95 security vendors on VirusTotal, with the domain appearing in 6 threat intelligence pulses on a major open-source threat exchange platform. The domain was registered on June 14, 2026, through Web Commerce Communications Limited dba WebNic.cc, a registrar frequently observed in malicious infrastructure deployments. Infrastructure analysis reveals the domain resolves to the IP address 172.67.202.97 and is protected by Cloudflare, a common tactic to obfuscate hosting origins. Additionally, powwowski.com is listed on 2 security blocklists, further corroborating its malicious intent. The use of HTTP/3 and Cloudflare technologies suggests an attempt to evade detection and enhance operational resilience. Users who accessed powwowski.com are advised to take immediate action to mitigate potential risks. Any credentials entered on the site should be considered compromised and reset across all platforms where the same or similar passwords were used. Multi-factor authentication should be enabled where available, and users should monitor accounts for unauthorized activity, including login attempts, financial transactions, or changes to account settings. System scans using updated security tools are recommended to detect any secondary payloads or malware that may have been delivered. Network administrators should block the domain and its associated IP address (172.67.202.97) at the perimeter to prevent further exposure within their environments.