purlotor[.]mobile-am[.]vip

This domain, purlotor.mobile-am.vip, is confirmed to operate as a credential theft site designed to harvest login credentials from unsuspecting users, particularly those accessing mobile service portals. Analysis indicates the site employs deceptive tactics, such as mimicking legitimate mobile authentication interfaces, to trick users into entering sensitive information, including usernames, passwords, and potentially multi-factor authentication codes. The domain's infrastructure and content structure align with known credential harvesting campaigns, where stolen data is exfiltrated to attacker-controlled servers for subsequent exploitation in account takeovers or identity fraud. Infrastructure analysis reveals multiple technical indicators supporting this classification. The domain was registered on June 12, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.157.31, which has been linked to other malicious activities. On VirusTotal, 12 out of 95 security vendors have flagged this domain as malicious, with detections spanning categories such as phishing, credential theft, and fraudulent activity. Additionally, the domain appears on one security blocklist, further corroborating its malicious nature. The SSL certificate issued by Google Trust Services does not mitigate the risk, as attackers commonly leverage trusted certificates to lend false legitimacy to phishing sites. Users who have visited purlotor.mobile-am.vip or entered credentials on this site should take immediate action to mitigate potential compromise. First, reset passwords for any accounts accessed or entered on the site, prioritizing email, financial, and mobile service accounts. Enable multi-factor authentication (MFA) using app-based or hardware tokens, avoiding SMS-based methods where possible. Monitor accounts for unauthorized activity, such as logins from unfamiliar locations or devices, and report suspicious transactions to the respective service providers. If financial or personally identifiable information was disclosed, consider placing a fraud alert or credit freeze with relevant credit bureaus. Organizations should block this domain and its associated IP address (172.67.157.31) at the network level to prevent further exposure.