fwfnctwtylozrle[.]dhisoaps[.]info

This domain, fwfnctwtylozrle.dhisoaps.info, is flagged as an active credential harvesting phishing site designed to steal user login credentials through deceptive login portals. Analysis indicates the infrastructure is specifically engineered to mimic legitimate authentication pages, likely targeting corporate or financial service users. The site employs social engineering tactics to trick victims into entering sensitive information, which is then exfiltrated to attacker-controlled servers for immediate exploitation or resale on underground markets. Infrastructure analysis reveals multiple high-risk indicators. The domain is detected by 7 out of 95 security vendors on VirusTotal, a significant detection rate for a newly deployed phishing operation. It resolves to IP address 104.21.71.158, a shared hosting environment commonly abused for phishing campaigns due to its low cost and high availability. The SSL certificate is issued by Google Trust Services, providing a false sense of security while encrypting malicious traffic. The page title, 'Site is created successfully!', suggests a recently deployed template or automated phishing kit, which often includes pre-configured credential harvesting scripts and exfiltration endpoints. Users who have visited fwfnctwtylozrle.dhisoaps.info should take immediate remediation steps. First, terminate any active sessions and disconnect from the network to prevent further data exposure. Second, rotate all credentials entered on the site, prioritizing accounts with financial or administrative privileges. Third, inspect local systems for signs of compromise, including unexpected browser extensions, modified host files, or unusual network connections to the IP 104.21.71.158. Organizations should block the domain and IP at the perimeter level and monitor for internal connections to these indicators. If sensitive data was entered, consider reporting the incident to relevant data protection authorities and implement additional authentication controls such as hardware tokens or biometric verification.