chongtar[.]ekklesiadallas[.]info

This domain is flagged as a high-risk credential theft phishing site, designed to harvest user login credentials through deceptive discount offers. The page title, 'Oferta specjalna: 90–95% taniej,' suggests a localized campaign targeting Polish-speaking users, likely impersonating retail or e-commerce platforms to lure victims into entering sensitive information. Analysis indicates the domain is registered through NameSilo, LLC, and resolves to IP address 172.67.175.245, hosted on Cloudflare infrastructure (AS13335). VirusTotal detection shows 16 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and remains active at the time of this report. The SSL certificate is issued by Google Trust Services (WE1), which does not mitigate the underlying threat. Infrastructure analysis reveals the use of Cloudflare, a common tactic to obscure hosting details and evade takedowns. Mitigation steps for credential theft phishing include immediate blocking of the domain and associated IP (172.67.175.245) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) across endpoint detection and response (EDR) systems, email gateways, and web proxies. User awareness training should emphasize the risks of fake discount offers, particularly those using non-ASCII characters or urgent language. Organizations should monitor for credential reuse attempts and enforce multi-factor authentication (MFA) to mitigate account takeovers stemming from this campaign.