com-verify[.]site

This domain, com-verify.site, has been identified as a credential phishing portal designed to harvest login credentials from financial service users. Analysis indicates the site mimics legitimate account verification processes, likely targeting users of banking or cryptocurrency platforms. No specific brand impersonation or drainer kit signatures were conclusively identified in initial scans, though the infrastructure aligns with known credential harvesting campaigns observed in mid-2026. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with short-lived phishing domains. The domain resolves to the IP address 94.154.172.39, hosted on an Apache HTTP Server. Detection metrics confirm high-risk classification, with 12 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on four security blocklists and has been included in seven threat intelligence pulses on AlienVault OTX. Google Safe Browsing (GSB) status was not explicitly provided, but the domain's presence across multiple detection platforms suggests prior active blocking. As of the latest assessment, com-verify.site has been taken offline, likely in response to detection and reporting. However, the underlying infrastructure remains a residual risk, as the IP address and registrar have been linked to prior phishing campaigns. Users who interacted with the domain are advised to rotate credentials immediately, particularly for financial accounts, and monitor for unauthorized transactions. Organizations should update blocklists to include the domain and associated IP, while security teams should investigate potential lateral movement or secondary infections from exposed credentials.