p4[.]olamna[.]click

This domain, p4.olamna.click, has been assessed as a high-risk credential-harvesting phishing site. Analysis indicates the infrastructure is designed to mimic legitimate login portals, tricking users into submitting sensitive authentication details such as usernames, passwords, and multi-factor authentication codes. The absence of an SSL certificate further increases the risk of data interception during transmission, while the generic page title 'Site is created successfully!' suggests a hastily deployed or automated phishing kit, commonly associated with large-scale credential theft campaigns. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain was registered on September 23, 2025, through Sav.com, LLC, a registrar frequently observed in phishing operations due to its accessibility and low oversight. It resolves to the IP address 178.16.53.103, hosted under AS202412 (Omegatech LTD) in the Netherlands, a network segment historically linked to fraudulent activities. Detection metrics show 17 out of 95 security vendors on VirusTotal flagging the domain as malicious, while Google Safe Browsing independently classifies it as a phishing threat. The domain appears on at least one security blocklist and is currently offline, though this status may change if the threat actor redeploys the infrastructure. No legitimate content or services were identified during the assessment period. Mitigation against credential-harvesting phishing sites like p4.olamna.click requires a multi-layered approach. Organizations should implement strict domain monitoring to detect and block newly registered lookalike domains, particularly those lacking SSL certificates or hosted on high-risk autonomous systems. End-users should be trained to verify domain authenticity before entering credentials, especially when encountering generic page titles or unexpected login prompts. Enabling multi-factor authentication (MFA) with phishing-resistant methods, such as hardware tokens or app-based one-time passwords, can significantly reduce the impact of credential compromise. Network-level protections, including real-time DNS filtering and automated takedown requests for confirmed phishing domains, are recommended to disrupt the operational lifecycle of such threats.