23[.]rewardinglocker[.]com

This domain operates as a fraudulent rewards portal designed to harvest user credentials, payment details, and personally identifiable information (PII). Analysis indicates the site mimics legitimate loyalty programs or promotional offers, using social engineering tactics to prompt victims into entering sensitive data. The infrastructure employs dynamic content delivery via PHP and frontend frameworks like Bootstrap and jQuery, which are commonly abused to create convincing fake interfaces. The domain’s recent creation and use of a valid SSL certificate further enhance its deceptive appearance, increasing the likelihood of successful compromise. Evidence confirms the domain’s malicious intent through multiple technical indicators. The domain 23.rewardinglocker.com was registered on July 25, 2025, through Cloudflare, Inc., and currently resolves to the IP address 188.114.97.3. Security vendors have flagged the domain in 15 out of 95 VirusTotal scans, with detections including phishing, credential theft, and fraudulent activity. The SSL certificate, issued by Google Trust Services, provides HTTPS encryption, which is frequently exploited to lend credibility to malicious sites. Additional infrastructure analysis reveals the use of Google Analytics and Cloudflare Browser Insights, tools often leveraged to track victim interactions and optimize phishing campaigns. Users who have visited 23.rewardinglocker.com or entered credentials on the site should take immediate action to mitigate risk. First, revoke any submitted credentials, particularly for financial or email accounts, and enable multi-factor authentication where available. Monitor accounts for unauthorized transactions or suspicious activity, and report any anomalies to the respective service providers. Clear browser caches and stored credentials to remove residual traces of the phishing attempt. If payment details were entered, contact financial institutions to block transactions and request fraud alerts. Security teams should block the domain and its resolving IP (188.114.97.3) at the network level to prevent further exposure.