defilcama[.]com

This domain is flagged as a credential-harvesting phishing site impersonating Gmail, designed to deceive users into submitting login credentials. The page title "Google" and infrastructure hosted under Google LLC (AS15169) suggest an attempt to mimic legitimate Google services, increasing the likelihood of successful social engineering attacks. Analysis indicates the domain was likely created to exploit trust in the Gmail brand for unauthorized account access or data exfiltration. Infrastructure analysis reveals the domain was registered on December 07, 2024, through Dynadot LLC and resolves to the IP address 172.217.18.4. It appears on one security blocklist and is flagged by 13 out of 95 security vendors on VirusTotal. The absence of an SSL certificate further indicates a lack of basic security measures, a common characteristic of low-effort phishing campaigns. The domain’s current offline status suggests takedown action, but its recent creation date implies potential for re-emergence under similar infrastructure. Users who visited defilcama.com should immediately reset their Gmail credentials, particularly if login details were entered. Enable multi-factor authentication (MFA) on all accounts to mitigate unauthorized access risks. Monitor linked accounts for suspicious activity, such as unauthorized logins or password change requests. If financial or sensitive data was submitted, consider reporting the incident to relevant authorities for further investigation. Organizations should update blocklists to include this domain and its associated IP to prevent future exposure.