e-serviceparts[.]info

This domain is flagged as a high-risk phishing site designed to impersonate Google Account login portals. The site presents a fraudulent sign-in page titled 'Sign in - Google Accounts,' mimicking legitimate Google authentication interfaces to deceive users into submitting their credentials. The primary threat posed by e-serviceparts.info is credential harvesting, where attackers capture usernames, passwords, and potentially multi-factor authentication tokens, enabling unauthorized access to victims' Google services, including Gmail, Drive, and associated third-party accounts. Analysis indicates this domain exhibits multiple technical indicators of malicious activity. It is detected by 14 out of 95 security vendors on VirusTotal, with a significant presence in threat intelligence platforms, including 50 pulses on AlienVault OTX. The domain resolves to the IP address 3.161.82.73, hosted on Amazon Web Services infrastructure, and utilizes Amazon CloudFront as a content delivery network. The SSL certificate is issued by Amazon, a common tactic to lend superficial legitimacy to phishing sites. Registration details point to the registrar Support.gandi, though no creation date is provided in the available data. The domain appears on four security blocklists, including PhishDestroy and PhishingDB, further corroborating its malicious classification. Users who visited e-serviceparts.info or entered credentials on the site should take immediate action to mitigate potential compromise. First, change the password for the affected Google Account and any other accounts where the same credentials may have been reused. Enable multi-factor authentication if not already active, using an authenticator app or hardware key rather than SMS-based methods. Review recent account activity for unauthorized access, including connected apps, email forwarding rules, and device sessions. Monitor for signs of identity theft or follow-up attacks, such as phishing emails or fraudulent transactions. If financial or sensitive data was exposed, consider placing a fraud alert or credit freeze with relevant institutions. Organizations should block the domain and associated IP address (3.161.82.73) at the network level to prevent further access.