fretchlop[.]pro

This domain, fretchlop.pro, presents an elevated-risk phishing threat designed to harvest user credentials through deceptive login portals. Analysis indicates the site mimics legitimate authentication pages, tricking visitors into submitting sensitive information such as usernames, passwords, or financial details. The absence of an SSL certificate further increases the risk of data interception during transmission, as unencrypted connections are vulnerable to man-in-the-middle attacks. While the specific brand impersonated remains unconfirmed, the domain’s infrastructure and behavior align with credential-theft campaigns targeting corporate or financial services users. Evidence supporting this assessment includes detection by 18 of 95 security vendors on VirusTotal, with the domain appearing on two independent blocklists. Infrastructure analysis reveals the domain was registered on December 13, 2024, through NameCheap, Inc., a registrar frequently associated with malicious domains due to its low-cost registration and privacy protection services. The domain resolves to the IP address 162.0.229.125, hosted on AS22612 (Namecheap, Inc.) in the United States. The page title 'Index of /' suggests an exposed directory listing, a common misconfiguration in hastily deployed phishing sites that may inadvertently reveal backend files or scripts used in the attack. Users who visited fretchlop.pro or entered credentials on the site should assume their information has been compromised. Immediate actions include changing passwords for any accounts accessed from the same device or network, particularly if the credentials match those used on the phishing site. Enable multi-factor authentication (MFA) on critical accounts to mitigate unauthorized access. Monitor financial statements and account activity for signs of fraudulent transactions. If corporate credentials were exposed, notify the organization’s security team to investigate potential lateral movement or data breaches. The domain’s current offline status does not eliminate risk, as harvested data may still be exploited by threat actors.