viw8t[.]com

This domain, viw8t.com, is confirmed to host a credential theft operation targeting users of retail and e-commerce platforms. The site presents itself under the title 'Savdo markazi,' a term commonly associated with commercial or marketplace services, suggesting an attempt to deceive users into entering sensitive login or payment details. The infrastructure is designed to mimic legitimate retail portals, increasing the likelihood of successful credential harvesting from unsuspecting victims. Analysis of the domain reveals multiple technical indicators supporting its malicious classification. The domain was registered on May 16, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate retail sites. It resolves to the IP address 188.114.97.3 and employs technologies such as Vue.js, jQuery, and Cloudflare, which are frequently used to enhance phishing site functionality and evade detection. The SSL certificate is issued by Let's Encrypt, a common choice for threat actors due to its ease of acquisition. Security vendors on VirusTotal flagged the domain at a rate of 16/95, and it appears on one blocklist, further corroborating its malicious intent. The Gridinsoft trust score of 0/100 underscores the domain's high-risk nature. Users who have visited viw8t.com or entered credentials on the site should take immediate action to mitigate potential compromise. First, reset passwords for any accounts accessed or entered on the site, prioritizing those linked to financial or personal data. Enable multi-factor authentication (MFA) where available to add an additional layer of security. Monitor accounts for unauthorized transactions or suspicious activity, and report any anomalies to the respective service providers. If payment details were submitted, contact financial institutions to flag potential fraudulent activity. Finally, scan local devices for malware, as credential theft sites may deploy additional payloads to maintain persistence or exfiltrate further data.