105633333[.]com

This domain, 105633333.com, is confirmed to host a credential harvesting phishing operation targeting users through fraudulent login portals. Analysis indicates the site mimics legitimate authentication pages to capture usernames, passwords, and other sensitive credentials, which are then exfiltrated to attacker-controlled infrastructure. The threat primarily affects individuals who interact with the domain through phishing links distributed via email, messaging platforms, or malvertising campaigns. Infrastructure analysis reveals the domain was registered on January 17, 2023, through a large registrar and remains active as of this report. It resolves to the IP address 172.67.208.51 and is flagged by 11 out of 95 security vendors on VirusTotal, with detections including generic phishing and malicious URL categories. The SSL certificate, issued by Google Trust Services, provides a false sense of legitimacy, further increasing the risk of successful credential theft. No legitimate business or service is associated with this domain. Users who have visited 105633333.com or entered credentials on the site should immediately revoke access to any accounts that may have been exposed. Reset passwords using a secure device and enable multi-factor authentication where available. Monitor accounts for unauthorized activity and report any suspicious transactions. Network administrators should block the domain and its associated IP (172.67.208.51) at the perimeter to prevent further access. If browser sessions were active during the visit, clear cached data and run a full antivirus scan to detect potential malware delivered through the phishing site.