etisalcmpez[.]click

This domain, etisalcmpez.click, operates as a fraudulent telecom payment portal designed to harvest user credentials and financial information. The site mimics legitimate mobile carrier billing pages, presenting users with a fake interface titled 'Pay postpaid bill or recharge your prepaid plan online.' Analysis indicates the domain is actively soliciting sensitive data under the guise of bill payment or prepaid top-up services, a common tactic in credential phishing and financial fraud campaigns targeting telecom subscribers. Infrastructure analysis reveals the domain was registered on June 28, 2024, through Dynadot, LLC, and currently resolves to the IP address 104.21.30.236. The site employs Cloudflare for content delivery and protection, including Cloudflare Browser Insights for performance monitoring, and supports HTTP/3 for enhanced connectivity. Security vendor detection on VirusTotal stands at 12 out of 95 engines, indicating moderate but growing awareness of the threat. The domain appears in one threat intelligence pulse on AlienVault OTX, and its SSL certificate is issued by Google Trust Services, adding a veneer of legitimacy to the malicious endpoint. Users who have interacted with etisalcmpez.click should immediately cease all engagement and perform a full security review of their devices. Credentials entered on the site must be considered compromised and should be changed across all platforms where reused. Financial institutions should be notified if payment details were submitted. Network-level blocking of the domain and its resolving IP (104.21.30.236) is recommended for enterprise environments. Monitoring for unauthorized transactions or account access is critical, as stolen data may be exploited in follow-on attacks.