navfeedbacknfcu[.]wasmer[.]app

PhishDestroy identifies navfeedbacknfcu.wasmer.app as an active brand impersonation phishing domain targeting Navy Federal Credit Union (NFCU) members. The domain utilizes deceptive branding to trick victims into surrendering NFCU credentials or installing malicious payloads. The infrastructure is consistent with modern phishing kits designed to evade detection by mimicking legitimate NFCU feedback portals while distributing crypto drainers or harvesting login data.

This domain exhibits multiple red flags across security platforms. VirusTotal analysis shows 24 out of 95 security vendors flagged the domain as malicious, indicating widespread suspicion. The domain resolves to IP address 62.210.172.150 and utilizes a Let's Encrypt SSL certificate to appear legitimate. Google Safe Browsing classifies the domain under SOCIAL_ENGINEERING attacks, confirming its malicious intent. The domain is hosted on a shared infrastructure in France (OVH SAS) with no verifiable connection to the legitimate Navy Federal Credit Union domain (navyfederal.org).

As of the latest intelligence, navfeedbacknfcu.wasmer.app remains active with a high risk level. All available threat intelligence sources classify this domain as a high-confidence threat requiring immediate action. Organizations and individuals should block this domain at the network and endpoint levels. Users who accessed this domain should assume credential compromise and revoke any NFCU-related passwords immediately. Financial institutions should alert customers about this specific campaign and monitor for fraudulent transactions linked to compromised accounts.