mx20[.]goteal[.]io

This domain, mx20.goteal.io, is identified as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the domain is designed to mimic legitimate authentication portals, tricking visitors into submitting sensitive credentials such as usernames, passwords, and potentially multi-factor authentication codes. The infrastructure is frequently associated with campaigns impersonating corporate or cloud service logins, increasing the likelihood of successful credential theft for subsequent unauthorized access or lateral movement in compromised environments. Evidence supporting this assessment includes detection by 9 of 95 security vendors on VirusTotal, categorizing the domain as malicious. The domain was registered through GoDaddy.com, LLC on June 28, 2016, and currently appears on one security blocklist. Infrastructure analysis reveals the domain resolves to the IP address 52.44.87.47, hosted on AWS EC2 in the us-east-1 region. The page title, mx20.goteal.io, further confirms the domain's self-referential nature, a common tactic to avoid immediate suspicion during phishing operations. Users who visited mx20.goteal.io or entered credentials on the site should assume their login details are compromised. Immediate actions include resetting passwords for any accounts accessed through the site, enabling multi-factor authentication where available, and monitoring affected accounts for unauthorized activity. System administrators are advised to block the domain and its associated IP (52.44.87.47) at the network perimeter to prevent further exposure. If corporate credentials were used, internal security teams should initiate incident response protocols to assess potential impact on organizational systems.