r5115r[.]com

This domain is flagged as a credential-harvesting phishing site designed to impersonate the legitimate 5115.com platform. Analysis indicates the site presents a fraudulent login interface under the page title '5115.com,' tricking users into entering sensitive account details such as usernames, passwords, or financial information. The infrastructure is engineered to closely resemble the authentic service, increasing the likelihood of successful deception, particularly among users expecting to access the real 5115.com portal. Infrastructure analysis reveals multiple high-confidence indicators of malicious intent. The domain r5115r.com was registered on September 20, 2024, through GoDaddy.com, LLC, and resolves to the IP address 154.213.177.126, hosted on AS54801 (Zillion Network Inc.) in Japan. Security vendors have detected this threat with significant consensus: 17 out of 95 engines on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist. The SSL certificate, issued by Let's Encrypt (serial R12), does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. Users who visited r5115r.com should take immediate action to secure their accounts. If credentials were entered, change passwords on the legitimate 5115.com site and any other platforms where the same credentials may have been reused. Monitor accounts for unauthorized activity, such as logins from unfamiliar locations or devices, and enable multi-factor authentication where available. Avoid clicking on links in unsolicited messages or emails directing to login pages, and verify domain names in the browser address bar before entering sensitive information. If financial data was exposed, contact the relevant institution to report potential fraud and request account monitoring.