mail[.]new-ulasan[.]business-minagne[.]com

This domain, mail.new-ulasan.business-minagne.com, is identified as a fake email portal designed to harvest user credentials through deceptive login interfaces. Analysis indicates the page mimics legitimate email service providers, tricking visitors into entering sensitive account details under false pretenses. The campaign targets corporate and personal email users, potentially leading to unauthorized account access, data exfiltration, or further malicious activity such as business email compromise (BEC) attacks. Infrastructure analysis reveals the domain was registered on July 09, 2024, through Aceville Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.218.44, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic to evade detection. As of the latest assessment, 20 out of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on one security blocklist. Notably, the domain lacks an SSL certificate, increasing the likelihood of interception during credential transmission. Users who visited mail.new-ulasan.business-minagne.com or entered credentials on the page should immediately revoke access to any compromised accounts and enable multi-factor authentication (MFA) where available. Affected systems should undergo a full security scan to detect potential malware or unauthorized access. Network administrators are advised to block the domain and its resolving IP (172.67.218.44) at the perimeter level to prevent further exposure. Monitoring for unusual login attempts or data access patterns is strongly recommended.