dinodiop[.]com

This domain, dinodiop.com, is identified as a credential theft operation designed to harvest user login credentials through deceptive web forms. Analysis indicates the site mimics legitimate authentication portals, tricking victims into submitting sensitive information such as usernames, passwords, and multi-factor authentication codes. The infrastructure is optimized for rapid deployment and evasion, with a focus on targeting users across multiple sectors, including financial services, cloud storage, and corporate networks. Evidence supporting this assessment includes detection by 11 out of 95 security vendors on VirusTotal, indicating a moderate but consistent level of malicious classification. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk registrations. Infrastructure analysis reveals the domain resolves to IP address 172.67.150.162, a host with a history of supporting malicious campaigns. Additionally, dinodiop.com appears on one security blocklist, further validating its malicious intent. Users who have visited dinodiop.com or entered credentials on the site should immediately revoke any active sessions associated with the account, change passwords for all linked services, and enable multi-factor authentication where available. Monitor financial and digital accounts for unauthorized activity, and report any suspicious transactions to the relevant service providers. If corporate credentials were exposed, notify internal security teams to initiate incident response protocols, including credential rotation and network traffic analysis for signs of lateral movement.