click2prize[.]com

This domain, click2prize.com, operates as a credential theft platform designed to deceive users into submitting login credentials under the guise of prize giveaways or rewards. Analysis indicates the site employs social engineering tactics, presenting a fabricated welcome page with prompts to enter sensitive information, which is then exfiltrated to attacker-controlled infrastructure. The domain’s structure and content suggest a focus on harvesting usernames, passwords, and potentially multi-factor authentication codes, commonly used in follow-up account takeovers or identity fraud schemes. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered on August 04, 2025, through Alibaba Cloud Computing Ltd. d/b/a HiChina, and resolves to the IP address 43.166.254.239, hosted in a US-based autonomous system (AS132203). Security vendors on VirusTotal flagged the domain at a rate of 17/95, while it appears on two independent security blocklists. The SSL certificate, issued by Let’s Encrypt (R13), provides encrypted communication but does not validate legitimacy, a common tactic in phishing operations to evade basic detection. Users who visited click2prize.com or interacted with its content should take immediate remediation steps. If credentials were entered, reset passwords for all associated accounts, prioritizing financial, email, and identity services. Enable multi-factor authentication where available, using app-based or hardware tokens instead of SMS. Monitor accounts for unauthorized activity, including login attempts, transactions, or changes to security settings. Report the incident to relevant security teams or incident response platforms to contribute to threat intelligence and prevent further exploitation. Network administrators should block the domain and associated IP at perimeter defenses to prevent internal access.