uat[.]sitemaps[.]wetlandrestorationecology[.]com

This website mimics a legitimate sitemap service to steal login credentials or install malware. Visitors are redirected to fake login pages that harvest usernames, passwords, or payment details without their knowledge. The attackers rely on misspelled URLs and look-alike branding to trick users into entering sensitive information on pages that appear authentic but are controlled by criminals. uat.sitemaps.wetlandrestorationecology.com was registered through Key-Systems GmbH on March 18 2017 and currently resolves to IP address 185.149.120.183.

PhishDestroy’s investigation shows this exact domain has been flagged by 9 out of 95 VirusTotal security vendors, indicating widespread recognition of its hostile nature. The site also holds a valid Let’s Encrypt SSL certificate, which can give a false sense of security because HTTPS alone does not guarantee legitimacy. The combination of an old registration date, a suspicious subdomain prefix, and multiple vendor detections confirms this is an active phishing operation rather than a newly spun-up scam.

If you visited this site, stop entering any information immediately. Clear your browser cache and cookies, then run a full antivirus scan. Report the incident to your IT team or security provider with the exact URL and timestamp. Warn colleagues who may also have accessed the link. Consider changing passwords on other accounts—especially if you reused credentials anywhere else—because phishing pages often log keystrokes for later credential stuffing attacks.