http://coin.promo548.com/lrnlb?utm_campaign=FAST_1396_CB+GB_NEW+01&utm_content=en-123&cid=2&fbid=743582632168058&utm_medium=paid&utm_source=fb&utm_id=120239585297240495&utm_term=120239585624490495
172.67.159.75 · Cloudflare, Inc.
Toronto, Canada
46 days
200 · 19.8s
Valid· WE1, Google Trust Services, US
COMPLETED
Registered-domain escalation
Submit promo548.com as the primary IOC, enriched with evidence from hostile subdomains like coin.promo548.com.
No KB/IOK detections were recorded for this scan.
Technology · 4/5/2026
The page displays a branding consistent with a platform called SuccessPro, evidenced by the page title Achieve Your Goals and the header logo text 'SuccessPro'. The domain coin.promo548.com does not belong to SuccessPro and the HTML source shows a generic SPA shell with a logo text 'SuccessPro' but no official domain. The site loads external scripts from coin.promo548.com and uses Cloudflare, with a new SSL cert issued to promo548.com. This indicates a credential collection attempt hosted under a typosquor-like domain impersonating SuccessPro and rendering a dynamic login/credential capture flow via JavaScript.
High risk of credential harvesting impersonation. The domain is newly registered (46 days) and hosts a phish-like clone of the SuccessPro UI, with the page title and header indicating SuccessPro branding while the content is served from coin.promo548.com. The static HTML contains no forms, but the SPA likely renders and captures credentials through JavaScript bundles loaded from the attacker domain. The SSL certificate is issued to promo548.com, and the domain has Cloudflare infrastructure, but appreciable indicators show deliberate impersonation and data exfiltration potential. This warrants immediate action and takedown on abuse channels; suspend_domain and block_url should be considered, given the host and IOCs.
Suspend Domain