es-pacemento[.]com

This domain, es-pacemento.com, operates as an active credential harvesting phishing site designed to mimic legitimate login portals. Analysis indicates the infrastructure is engineered to collect usernames, passwords, and potentially multi-factor authentication codes through deceptive web forms. The site employs social engineering tactics, such as urgency-driven messaging or spoofed branding, to trick users into submitting sensitive credentials. Such attacks often lead to unauthorized account access, financial fraud, or lateral movement within compromised networks. Infrastructure analysis reveals the domain was registered on June 21, 2025, through Dominet (HK) Limited, a registrar frequently associated with malicious activity. As of the latest scan, 12 out of 95 security vendors on VirusTotal flag es-pacemento.com as malicious, while it appears on one additional security blocklist. The domain remains active despite detection, indicating ongoing operational intent. The combination of recent registration, low detection prevalence, and active status suggests a targeted or evolving campaign with limited prior exposure. Users who visited es-pacemento.com or entered credentials on the site should immediately revoke any submitted passwords and enable multi-factor authentication on associated accounts. Monitor linked financial or email accounts for unauthorized activity, as compromised credentials may be exploited within hours. Security teams should block the domain at the network level and inspect logs for connections to 104.21.82.176 or 172.67.158.224, the current resolved IPs. If credentials were entered, assume full account compromise and initiate password resets for all potentially affected services. Organizations should also review endpoint telemetry for indicators of post-compromise activity, such as unusual login attempts or data exfiltration.