camelot[.]exc-v3[.]run

This domain is flagged as a credential harvesting phishing site designed to deceive users into submitting login credentials through fraudulent web forms. The site mimics legitimate services to trick visitors into entering sensitive information, which is then captured by threat actors for unauthorized access or financial fraud. Analysis indicates the domain was constructed to exploit trust in familiar branding, a common tactic in phishing campaigns targeting both individuals and organizations. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., a provider frequently used to obscure hosting origins. The domain resolves to the IP address 172.67.154.41, associated with Cloudflare’s network (AS13335), and currently lacks an SSL certificate, increasing the risk of interception during data transmission. VirusTotal detections confirm the threat, with 12 out of 95 security vendors flagging the domain as malicious. The domain appears on at least one security blocklist and has since been taken offline, though similar domains may remain active. Users who visited camelot.exc-v3.run should immediately revoke any entered credentials, particularly for financial or email accounts. Monitor linked accounts for unauthorized activity, such as password changes or unrecognized transactions. Enable multi-factor authentication (MFA) on all critical services to mitigate further risk. If credentials were reused across multiple platforms, update passwords on those services as well. Report the incident to relevant security teams or incident response platforms to aid in tracking and mitigation efforts. Future vigilance is advised, as phishing domains often reappear under similar names or infrastructure.