encrypt-email[.]org

This domain, encrypt-email.org, is identified as a credential harvesting phishing site targeting users through deceptive email encryption-themed lures. The domain is currently offline, though historical activity and infrastructure analysis confirm its malicious intent. No specific brand impersonation has been confirmed, but the domain’s design and naming convention suggest an attempt to mimic legitimate encrypted communication services to harvest login credentials. Analysis indicates the domain was flagged by 16 of 95 security vendors on VirusTotal, reflecting broad consensus on its malicious nature. It was registered through Amazon Registrar, Inc. on August 3, 2017, and resolves to the IP address 3.254.19.217, hosted on Amazon infrastructure. The domain appears on two security blocklists and has been referenced in 50 threat intelligence pulses, underscoring its persistent use in phishing campaigns. The SSL certificate is issued by Amazon, which, while not inherently malicious, aligns with the domain’s hosting provider and does not mitigate the phishing risk. The domain’s current offline status does not eliminate the threat, as phishing infrastructure is frequently reactivated or repurposed. Organizations and users are advised to block the domain and its associated IP address at the network perimeter. Security teams should review logs for connections to 3.254.19.217 or the domain itself, particularly in email or web traffic. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended. Proactive monitoring for similar domains (e.g., variations of 'encrypt-email') is also advised, as threat actors often reuse naming conventions across campaigns.