mr-bel-informations[.]bolt[.]host

The domain mr-bel-informations.bolt.host has been identified as an active source of credential theft through brand impersonation, specifically targeting users of the Mondial Relay delivery service. The site presents a deceptive notification page titled 'Mondial Relay - Notification de livraison' and is designed to harvest sensitive user credentials under the guise of legitimate package notifications. This activity constitutes a significant threat by exploiting brand trust to facilitate unauthorized data collection.

Technical analysis reveals multiple risk indicators. The domain is currently active and resolves to IP address 104.26.13.118. It is protected by Cloudflare, Inc. as registrar and utilizes a Google Trust Services SSL certificate, as well as technologies such as Netlify, jsDelivr, HSTS, and Cloudflare CDN. The domain’s registration date is November 14, 2024, indicating recent establishment for this campaign. VirusTotal scan results show that 16 out of 95 security vendors have flagged the domain for malicious activity, confirming widespread detection across the infosec community.

Users who have visited mr-bel-informations.bolt.host are at high risk for exposure of personal credentials and should immediately change any potentially compromised passwords. It is recommended to monitor for unauthorized account activity and implement multi-factor authentication wherever possible. Affected individuals should also consult with security teams to assess further risk to their systems and take additional mitigation steps as necessary. The domain should be avoided and reported to relevant stakeholders for prompt remediation.