mn[.]com-cacos[.]my

This domain is flagged as an elevated-risk credential theft phishing infrastructure. Analysis indicates it is designed to harvest user login credentials, financial details, or other sensitive information through deceptive login portals or fraudulent forms. The domain exhibits characteristics consistent with targeted credential harvesting campaigns, including the use of obfuscated subdomains and SSL certificates to appear legitimate. Infrastructure analysis reveals the domain mn.com-cacos.my resolves to the IP address 104.21.82.210 and was registered on June 12, 2026. It is currently offline but was previously detected by 11 out of 95 security vendors on VirusTotal, indicating widespread recognition as malicious. The domain appears on at least one security blocklist and is associated with a Google Trust Services SSL certificate, which may be leveraged to create a false sense of security. Additional protective measures, such as those implemented by network security providers, have blocked access to this domain. To mitigate the risk of credential theft, users should avoid interacting with this domain or any linked resources. Organizations are advised to implement domain-based blocking at the network level, particularly for subdomains containing suspicious strings like 'com-cacos.' End-users should verify the authenticity of login pages by checking for HTTPS validity, domain ownership, and official branding. Multi-factor authentication (MFA) should be enabled on all accounts to reduce the impact of compromised credentials. Security teams should monitor for indicators of compromise, including the IP address 104.21.82.210 and the domain itself, in network logs and endpoint detection systems.