mail[.]tnk[.]deq[.]temporary[.]site

This domain, mail.tnk.deq.temporary.site, is a confirmed credential theft phishing site designed to harvest login credentials from unsuspecting users. The site mimics legitimate authentication portals, tricking visitors into entering sensitive information such as usernames, passwords, or other personal data. Once submitted, this information is captured and likely exploited for unauthorized access, financial fraud, or further targeted attacks against victims or their organizations. Analysis indicates this domain was created on August 04, 2023, and registered through ENOM, INC. It is flagged by 18 out of 95 security vendors on VirusTotal, with additional detections on at least one security blocklist. The domain resolved to the IP address 50.6.42.21, hosted by Oracle Corporation in India, and used a Let's Encrypt SSL certificate (R12) to appear legitimate. The page title 'Not Acceptable!' suggests either a misconfiguration or a deliberate attempt to evade automated detection systems. If you visited mail.tnk.deq.temporary.site or entered any credentials on this site, immediate action is required. First, change passwords for any accounts that may have been exposed, prioritizing email, financial, and work-related services. Enable multi-factor authentication (MFA) wherever possible to add an extra layer of security. Monitor accounts for suspicious activity, such as unauthorized logins or transactions, and report any anomalies to the respective service providers. Additionally, scan your device for malware, as phishing sites may distribute malicious payloads. If this domain was accessed in a corporate environment, notify your IT or security team to investigate potential compromise and mitigate further risks.