gstatictag[.]info

This domain, gstatictag.info, is identified as a credential harvesting phishing site designed to mimic legitimate authentication portals. Analysis indicates it targets users by presenting fraudulent login interfaces, likely impersonating trusted platforms to capture usernames, passwords, and other sensitive credentials. The domain employs social engineering tactics to deceive victims into submitting personal or corporate login details, which are then exfiltrated to attacker-controlled infrastructure. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain is flagged by 4 out of 95 security vendors on VirusTotal, appears on 1 security blocklist, and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. Notably, the domain was created on March 27, 2026, an anomalous future date suggesting potential registry manipulation or domain spoofing. It resolves to the IP address 188.114.96.3 and has been observed in 1 threat intelligence pulse on AlienVault OTX, further corroborating its association with phishing campaigns. Users who visited gstatictag.info or entered credentials on any page hosted under this domain should immediately revoke and reset all exposed passwords, particularly for corporate or financial accounts. Enable multi-factor authentication (MFA) on all critical services to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions, and report any anomalies to the respective security teams. If corporate devices were used, initiate an endpoint scan for malware or unauthorized modifications, and isolate the device from the network until verified clean. Organizations should update internal blocklists to prevent future access to this domain and its associated IP address.