amalrehatk[.]com

This domain, amalrehatk.com, poses a significant threat as a brand impersonation site targeting Gmail. The site is designed to deceive users into believing they are interacting with a legitimate Gmail service, potentially leading to the theft of sensitive information such as login credentials and personal data.

Infrastructure analysis reveals that amalrehatk.com was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on November 24, 2024. The domain has been flagged by 16 out of 95 security vendors on VirusTotal, indicating a notable level of suspicion and potential malicious activity. The domain resolves to the IP address 195.201.80.26, which is located in Germany and is part of the AS24940 Hetzner Online GmbH network. Additionally, the domain appears on two security blocklists, PhishDestroy and PhishingDB, further confirming its malicious nature. The SSL certificate is issued by Let's Encrypt, which is a common practice among phishing sites to appear more trustworthy to users.

Users who have visited amalrehatk.com are advised to take immediate action to protect their accounts. First, they should change their Gmail passwords and enable two-factor authentication (2FA) to add an extra layer of security. It is also recommended to review recent account activity for any unauthorized actions. If any sensitive information was entered on the site, users should contact their financial institutions and monitor their accounts for suspicious transactions. Furthermore, users should report the incident to their email provider and consider using a password manager to generate and store complex, unique passwords for all online accounts.