reo-proposal[.]com

The domain reo-proposal.com, which mimicked the Accor brand, is flagged by 5 out of 91 vendors on VirusTotal. It is also listed on three public blocklists: PhishDestroy, MetaMask, and SEAL. The site, now offline, was designed to deceive users by posing as a legitimate Accor Marrakech EPK page, as indicated by its page title, 'Riad El Omor — Accor Marrakech EPK.'

Registered with NameCheap, Inc., the domain was hosted on IP address 64.29.17.65 and used an SSL certificate issued by Let's Encrypt. The presence of this domain on multiple blocklists and its offline status suggest that it was part of a larger phishing operation targeting users familiar with the Accor brand. The use of a reputable SSL issuer like Let's Encrypt might have been intended to lend credibility to the fraudulent site.

The domain's takedown indicates effective intervention by security teams, but its initial success in evading detection highlights the ongoing challenge of combating phishing threats. Phishing domains like reo-proposal.com exploit the time lag between domain registration and detection by antivirus databases, typically 24-72 hours. PhishDestroy's upstream detection capabilities help identify these threats during this critical window, providing an advantage in the fight against phishing attacks.