contrat-raiffeisen[.]info

This domain, contrat-raiffeisen.info, is actively engaged in credential theft phishing operations targeting users of financial institutions. Analysis indicates the site impersonates legitimate banking portals to harvest login credentials, enabling unauthorized account access and subsequent fraudulent transactions. The infrastructure is designed to deceive users into entering sensitive authentication details under the guise of a trusted financial service provider. Infrastructure analysis reveals the domain was registered on July 10, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. It resolves to the IP address 45.74.61.11, which has been linked to prior phishing campaigns. Detection metrics show that only 2 out of 95 security vendors on VirusTotal currently flag this domain, suggesting limited visibility despite its active malicious status. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to fraudulent sites. Users who have visited contrat-raiffeisen.info or entered credentials on the site should immediately revoke any submitted login details by resetting passwords through official banking channels. Financial institutions should be notified of potential account compromise, and affected systems should be scanned for malware or unauthorized access. Monitoring for unusual transaction activity is strongly recommended, as credentials harvested from this campaign may be exploited in real-time or sold on underground markets for future misuse.