win138[.]clotho[.]quantumblack[.]com

PhishDestroy identifies win138.clotho.quantumblack.com as a credential theft domain currently marked under investigation by the threat intelligence database.

The domain was flagged by 1 of 95 VirusTotal vendors, raising concerns despite its Let's Encrypt SSL certificate. Registered through Amazon Registrar, Inc. as of January 10, 2009, it resolves to IP address 216.107.138.214. Notably, VirusTotal’s current detection rate remains at 1 of 95 scanners, indicating a potential zero-day threat requiring manual verification. Historical analysis shows no prior inclusion in major blocklists, though its age and unregistered status suggest potential for reuse in phishing campaigns targeting unsuspecting users.

As a credential theft domain with active status, this site poses a moderate risk due to its undetected nature and SSL certification. Users should avoid entering any credentials or personal data. Security teams are advised to block the domain at the network level and monitor for associated IPs or subdomains. Further investigation is ongoing to determine additional indicators of compromise and potential links to broader credential harvesting operations.