getretiksale[.]pages[.]dev

This domain, getretiksale.pages.dev, is a confirmed credential theft site impersonating Retik Finance. It poses a significant threat by tricking users into revealing their login credentials, which can be used for unauthorized access to their accounts and potential financial fraud.

Analysis indicates that 12 out of 95 security vendors on VirusTotal flag this domain as malicious. The domain was created on April 02, 2024, and is registered through Cloudflare Pages. It resolves to the IP address 172.66.44.64 and is currently active. Additionally, the site appears on three security blocklists: PhishDestroy, ScamSniffer, and Enkrypt. The SSL certificate is issued by Google Trust Services / WE1, which might give a false sense of security to unsuspecting visitors.

If a user has visited this domain, they should immediately change their login credentials for any accounts related to Retik Finance or any other financial services. It is also recommended to monitor account activities for any unusual transactions or unauthorized access. Users should report the incident to their financial institutions and consider enabling multi-factor authentication for added security.