kreditti[.]mx

The domain kreditti.mx is identified as a generic phishing site designed to impersonate a legitimate credit network, specifically targeting Spanish-speaking users with fraudulent loan offers. Analysis indicates the site operates under the guise of 'KREDITTI – Tu RED de apoyo express,' a fabricated financial service intended to harvest sensitive personal and financial information. The domain currently holds an elevated risk level and has been taken offline, though prior activity suggests it may re-emerge under similar infrastructure. Infrastructure analysis reveals the domain was registered on April 05, 2021, through Registrar.eu and resolves to the IP address 198.251.84.200. Detection metrics show the domain is flagged by 5 of 95 security vendors on VirusTotal, with one confirmed presence on a security blocklist. The site employed a Let's Encrypt SSL certificate, a common tactic among phishing domains to appear legitimate. Technologies detected include WordPress, MySQL, PHP, Bootstrap, LiteSpeed, Swiper, Modernizr, and Lightbox, indicating a structured and deceptive web presence designed to mimic authentic financial platforms. Current status confirms the domain has been taken offline, though residual risk remains due to its historical activity and potential for reactivation. Users and organizations are advised to block the domain and its associated IP address (198.251.84.200) at the network level. Financial institutions should monitor for credential reuse from affected users, as harvested data may be exploited in subsequent fraud attempts. Security teams are recommended to review logs for connections to the domain or IP and implement proactive detection rules for similar phishing infrastructure.