excavate[.]lol

This domain is flagged as a credential harvesting phishing infrastructure targeting users through deceptive login or authentication prompts. The site impersonates legitimate platforms to capture sensitive credentials, including usernames, passwords, and potentially multi-factor authentication codes. The page title, 's0cial – Change Ourselves For Better Before They Change Us For Worse,' suggests a social engineering lure designed to exploit urgency or ideological alignment, increasing the likelihood of user engagement. Analysis indicates the domain was registered on November 06, 2025, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the use of Cloudflare for content delivery and protection, alongside Unpkg for resource hosting, which may obscure malicious payloads or scripts. The domain resolves to IP address 148.72.62.109 and is currently offline, though prior detections include 5/95 security vendors on VirusTotal flagging it as malicious. Additionally, the domain appears on one security blocklist, reinforcing its classification as a confirmed threat. Users who visited excavate.lol or interacted with its content should assume credential exposure and take immediate remediation steps. Reset passwords for any accounts accessed or entered on the site, prioritizing accounts with elevated privileges or financial access. Enable multi-factor authentication where available, using app-based or hardware tokens rather than SMS-based methods. Monitor linked accounts for unauthorized activity, including login attempts, transactions, or configuration changes. If the site was accessed via a corporate or institutional network, report the incident to internal security teams for further investigation and potential containment measures.