amateursnearby[.]com

This domain is flagged as an active fake login phishing portal targeting user credentials. Analysis indicates the infrastructure was specifically designed to mimic legitimate login pages, likely to harvest sensitive account information such as usernames, passwords, and session tokens. The presence of a generic page title ('Tony') and the absence of legitimate branding further support the assessment of a credential-harvesting operation. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain was registered on January 29, 2024, through NameCheap, Inc., a registrar frequently associated with phishing campaigns. It resolves to an IPv6 address (2600:9000:28c5:f600:6:db50:6b80:93a1) hosted on Amazon Web Services (AS16509), a common cloud provider for malicious infrastructure. Security vendors on VirusTotal flagged the domain with 13 out of 95 detections, while two security blocklists, including PhishDestroy and PhishingDB, have listed it as malicious. The SSL certificate, issued by Let's Encrypt (R12), provides minimal trust assurance, as it is routinely exploited by threat actors to lend a false sense of legitimacy to phishing pages. Mitigation steps for this specific threat type include immediate blacklisting of the domain and its associated IP address within enterprise security gateways and endpoint protection systems. Network administrators should verify that web filtering solutions are configured to block newly registered domains (NRDs) with low reputation scores, particularly those created within the last 90 days. End users who may have interacted with the site should be instructed to reset credentials for any accounts accessed during the exposure window, enable multi-factor authentication (MFA) where available, and monitor for unauthorized activity. Security teams should also conduct a retrospective analysis of proxy and DNS logs to identify any internal systems that may have communicated with the domain prior to its takedown.