p5[.]adca[.]click

This domain is flagged as a credential harvesting phishing site designed to mimic legitimate login portals. Analysis indicates it was created to deceive users into entering sensitive information such as usernames, passwords, or financial details, which are then captured by threat actors for malicious purposes. The site’s infrastructure and lack of security measures align with common phishing tactics observed in recent campaigns targeting both individuals and organizations. Infrastructure analysis reveals multiple technical indicators confirming its malicious nature. The domain was registered on September 23, 2025, through Sav.com, LLC, and resolves to the IP address 178.16.53.103, hosted under AS202412 Omegatech LTD in the Netherlands. It lacks an SSL certificate, increasing the risk of data interception during transmission. Security vendors on VirusTotal flagged the domain 17 out of 95 times, and it appears on at least one security blocklist. The page title, 'Site is created successfully!', suggests a placeholder or recently deployed phishing kit, a common trait in short-lived malicious domains. If a user visited p5.adca.click or interacted with its content, immediate action is required to mitigate potential risks. First, any credentials entered on the site should be considered compromised and changed immediately across all platforms where the same password was reused. Users should enable multi-factor authentication (MFA) on critical accounts to prevent unauthorized access. Devices used to access the site should be scanned for malware using updated security tools, as phishing pages may deploy additional payloads. Monitoring financial statements and credit reports for unusual activity is also recommended, particularly if sensitive information was submitted. Organizations should review logs for signs of credential abuse and consider revoking session tokens associated with the affected accounts.