105655777[.]com

This domain is flagged as an active credential theft operation targeting users through deceptive login portals and fraudulent authentication prompts. Analysis indicates the infrastructure is designed to harvest usernames, passwords, and session tokens, likely for subsequent unauthorized access to email accounts, financial services, or corporate systems. The threat actor may exploit stolen credentials for account takeovers, financial fraud, or lateral movement within compromised networks, posing significant risk to both individual and organizational security. Infrastructure analysis reveals the domain 105655777.com was registered through GoDaddy.com, LLC and currently resolves to the IP address 207.56.217.163. The domain is secured with a Let's Encrypt SSL certificate (YR1), a common tactic to lend false legitimacy to phishing pages. As of the latest scan, 21 out of 95 security vendors on VirusTotal have detected malicious activity associated with this domain, and it appears on at least one security blocklist. The elevated detection rate and blocklist inclusion suggest a well-established threat with measurable impact. Users who have visited 105655777.com or entered credentials on any page associated with this domain should immediately take corrective action. Revoke any active sessions on potentially compromised accounts, enable multi-factor authentication where available, and monitor accounts for unauthorized activity. If corporate credentials were exposed, notify internal security teams to initiate incident response protocols, including password resets and network access reviews. Browser-based credential managers should be audited for saved logins associated with this domain, and any suspicious entries should be removed. Persistent exposure may require a full device scan to rule out secondary infections or data exfiltration.