secure-index--camarerotem[.]replit[.]app

This domain, secure-index--camarerotem.replit.app, is actively engaged in credential theft, presenting users with a fraudulent login interface designed to harvest account credentials. The site mimics legitimate authentication pages, tricking visitors into entering sensitive information such as usernames, passwords, or multi-factor authentication codes. Once submitted, these credentials are transmitted to threat actors, enabling unauthorized access to personal or corporate accounts, financial fraud, or further exploitation through lateral movement in compromised environments. Analysis indicates the domain is hosted on infrastructure associated with Google LLC (AS396982), resolving to the IP address 34.117.33.233. The page title, 'Sign in to your account,' aligns with common credential phishing tactics. VirusTotal reports 19 out of 95 security vendors flagging this domain as malicious, providing a clear indicator of its harmful nature. The SSL certificate is issued by Google Trust Services (WR3), a detail often exploited by threat actors to lend false legitimacy to phishing sites. The domain is registered through Nom-IQ Limited dba Com Laude, though no creation date is provided in available intelligence. It appears on at least one security blocklist, reinforcing its classification as a high-risk threat. If a user has visited secure-index--camarerotem.replit.app or entered credentials on the site, immediate action is required. First, all passwords associated with the compromised account should be changed, prioritizing accounts with elevated privileges or access to sensitive data. Enable multi-factor authentication (MFA) if not already active, using app-based or hardware tokens rather than SMS-based methods. Monitor the affected accounts for unauthorized activity, including login attempts, password changes, or unusual transactions. Organizations should isolate any systems that accessed the domain and conduct a forensic review to determine if malware was downloaded or additional credentials were exposed. Report the incident to relevant security teams or platforms, such as internal IT departments or national cybersecurity authorities, to contribute to broader threat intelligence efforts.