ar[.]randao[.]net

This domain, ar.randao.net, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login information. The site presents a fraudulent Sign In page, mimicking legitimate authentication portals to capture usernames, passwords, and potentially other personal or financial details. Such attacks are commonly used to facilitate account takeovers, unauthorized access to corporate or personal data, and subsequent fraudulent activities, including identity theft or financial fraud. Analysis indicates that ar.randao.net was registered on February 21, 2026, through NameCheap, Inc., a registrar frequently observed in phishing campaigns due to its accessibility and low-cost domain registration services. The domain resolves to the IP address 138.201.220.159, hosted on infrastructure belonging to Hetzner Online GmbH (AS24940) in Germany. At the time of assessment, the domain was flagged by 17 out of 95 security vendors on VirusTotal, with detection labels including generic phishing and credential theft. The site employed a Let’s Encrypt SSL certificate (R12), a tactic often used by threat actors to lend an appearance of legitimacy to malicious domains. Additionally, the domain appeared on one security blocklist, further corroborating its malicious intent. Users who may have interacted with ar.randao.net should take immediate remedial actions to mitigate potential risks. First, any credentials entered on the site must be considered compromised and should be changed immediately across all platforms where the same or similar passwords were used. Enable multi-factor authentication (MFA) on critical accounts to add an additional layer of security. Monitor financial statements, account activities, and credit reports for signs of unauthorized access or fraudulent transactions. If corporate credentials were exposed, notify the organization’s IT or security team to initiate incident response protocols. Finally, ensure that endpoint security tools are updated and conduct a full system scan to detect any potential malware or backdoors that may have been installed during the interaction with the phishing site.