godlike-visit[.]online

This domain, godlike-visit.online, has been identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login information. Analysis indicates the infrastructure mimics legitimate authentication portals, likely targeting corporate or financial service accounts. The site employs social engineering tactics, such as urgent security alerts or password expiration notices, to prompt victims into entering credentials, which are then exfiltrated to attacker-controlled servers. Infrastructure analysis reveals the domain was registered on June 01, 2026, through Dynadot Inc, a registrar frequently observed in phishing operations. It resolves to the IP address 144.172.114.220, which has been flagged by 17 out of 95 security vendors on VirusTotal for malicious activity. Additionally, the domain appears on one security blocklist, further corroborating its malicious classification. The creation date suggests a recently deployed campaign, potentially still active or in rotation with other domains. Users who visited godlike-visit.online or entered credentials on the site should immediately revoke any submitted login details, particularly for accounts associated with financial, email, or corporate services. It is recommended to enable multi-factor authentication on all critical accounts and monitor for unauthorized access attempts. System administrators should block the domain and its associated IP (144.172.114.220) at the network perimeter to prevent further exposure. Victims should also scan their devices for malware, as phishing sites may deploy additional payloads.