affilio-osa[.]com

This domain is flagged as a credential theft operation targeting users of financial institutions. Analysis indicates the infrastructure was designed to impersonate legitimate banking portals, tricking visitors into entering account credentials, personal identification numbers, and multi-factor authentication codes. The site employs dynamic content loading to evade detection and uses obscured JavaScript to transmit stolen data to remote command-and-control servers. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain affilio-osa.com was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It resolves to IP address 172.67.203.212 and is currently offline, though historical records show active credential harvesting attempts. VirusTotal reports 5 out of 95 security vendors flagging this domain, while it appears on one security blocklist and is referenced in a single AlienVault OTX threat intelligence pulse. The Gridinsoft trust score of 0 out of 100 further corroborates its malicious classification. Users who visited affilio-osa.com should immediately revoke any entered credentials, particularly for banking or financial services. Monitor accounts for unauthorized transactions and enable multi-factor authentication where available. Clear browser cache and cookies to remove any residual tracking elements. If financial data was exposed, notify the affected institution and consider placing a fraud alert on credit reports. Security teams should block the domain and associated IP at the network perimeter to prevent further exposure.