webmal-0xcs-nets0l[.]replit[.]app

This domain, webmal-0xcs-nets0l.replit.app, operates as a credential phishing site designed to impersonate Network Solutions, a well-known domain registrar and web services provider. The site presents a fraudulent login page titled 'Sign in - Professional Email,' which mimics the legitimate Network Solutions interface to deceive users into entering their email credentials. Once submitted, these credentials are harvested by threat actors for unauthorized access, account takeovers, or further malicious activities such as business email compromise or identity theft. Analysis indicates that the domain was created on April 16, 2021, and is registered through NOM-IQ Ltd dba Com Laude. It resolves to the IP address 34.117.33.233, hosted on infrastructure belonging to Google LLC (AS396982) in the United States. The SSL certificate is issued by Google Trust Services under the WR3 intermediate. Detection data from VirusTotal reveals that 20 out of 95 security vendors flag this domain as malicious, and it appears on at least two security blocklists, including PhishDestroy and PhishingDB. These indicators confirm the domain's involvement in phishing operations targeting Network Solutions customers. If you or someone in your organization visited this domain and entered login credentials, immediate action is required. First, change the compromised password for the affected Network Solutions account and any other platforms where the same credentials may have been reused. Enable multi-factor authentication where available to add an additional layer of security. Monitor the account for suspicious activity, such as unauthorized logins or changes to account settings. Report the incident to your organization's security team or a trusted cybersecurity professional for further investigation. Additionally, consider notifying Network Solutions directly to alert them of the phishing attempt, as they may take steps to mitigate the threat for other users.