clickpuzzle123[.]info

This domain, clickpuzzle123.info, is identified as a credential theft phishing infrastructure targeting users through deceptive login portals. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, though the use of Cloudflare and jsDelivr suggests a scalable, obfuscated attack vector designed to harvest login credentials or personal data. The page title 'Un momento…' aligns with Cloudflare's default challenge page, which may have been exploited to mask malicious activity or serve as a temporary placeholder during redirection chains. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IPv6 address 2606:4700::6812:4aa and is registered through Cloudflare, Inc. It employs an SSL certificate issued by Google Trust Services, a common tactic to lend legitimacy to phishing pages. The domain is flagged by 5 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100, indicating high confidence in its malicious nature. It appears on one security blocklist and is currently categorized under generic phishing. The domain leverages HTTP/3 and Cloudflare's content delivery network, which may complicate detection and takedown efforts due to distributed hosting and encrypted traffic. As of the latest assessment, clickpuzzle123.info has been taken offline, likely due to enforcement actions or automated takedown mechanisms. However, the infrastructure remains a residual risk, as the domain could be reactivated or repurposed for future campaigns. Users who may have interacted with this domain are advised to reset credentials for any accounts accessed during the exposure window, enable multi-factor authentication, and monitor for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP address, while security teams should investigate potential lateral movement or follow-on attacks stemming from credential compromise.