898a155[.]com

PhishDestroy identifies a newly registered domain, 898a155.com, actively hosting a generic phishing page designed to harvest user credentials under the guise of a legitimate login portal. This site mimics trusted authentication interfaces to trick visitors into surrendering sensitive information such as usernames and passwords. Security teams are advised to treat this domain as a high-risk threat vector until further analysis is complete.

This domain was flagged by PhishDestroy with zero detections across 95 VirusTotal engines as of the latest scan. The domain was created on September 2, 2024, and is registered through GoDaddy.com, LLC. It resolves to the IP address 13.33.187.78 and currently holds an SSL certificate issued by Amazon, which may lend it an air of legitimacy to unsuspecting users. Despite its short operational period, the domain’s infrastructure and certificate usage suggest it has been configured for prolonged malicious activity, warranting immediate attention from security teams and users alike.

If you have visited 898a155.com or entered any credentials on the site, reset the associated passwords immediately and enable multi-factor authentication where available. Avoid reusing passwords across different services, as threat actors often exploit credential stuffing attacks. Report the domain to your security team or through your organization’s phishing reporting channels. If you suspect your credentials have been compromised, monitor linked accounts for unusual activity and consider enabling credit or identity monitoring services. Always verify URLs carefully and avoid clicking on unsolicited links, especially those directing you to login pages.