dosienews[.]com

This domain, dosienews.com, is actively engaged in credential theft operations, presenting itself as a benign blog to deceive visitors into submitting login credentials, personal data, or financial information. The site employs social engineering tactics, such as fake login prompts or forms, to capture sensitive user inputs, which are then exfiltrated to attacker-controlled infrastructure. Credential theft remains a prevalent threat vector, often leading to account takeovers, identity fraud, or unauthorized access to corporate or financial systems. Analysis indicates that dosienews.com exhibits multiple indicators of malicious intent. The domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with suspicious registrations. Despite its recent creation, the domain resolves to the IP address 188.114.96.3 and is currently flagged on one security blocklist, specifically PhishDestroy. VirusTotal reports 0 detections out of 95 engines, suggesting the site has not yet been widely flagged but remains under investigation due to its behavioral patterns. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, providing minimal assurance of safety. Additionally, the domain appears in one AlienVault OTX threat intelligence pulse, further corroborating its association with malicious activity. Users who have visited dosienews.com or interacted with its content should take immediate remedial actions. First, terminate any active sessions with the site and clear browser cookies or cached data to eliminate stored credentials. If login credentials or other sensitive information were entered, change passwords immediately for all potentially compromised accounts, prioritizing email, financial, and work-related platforms. Enable multi-factor authentication (MFA) where available to mitigate the risk of unauthorized access. Monitor accounts for suspicious activity, such as unrecognized logins or transactions, and report any anomalies to the respective service providers. For enterprise environments, isolate affected systems from the network and conduct a forensic analysis to determine the scope of exposure. Organizations should also update their security policies to block access to this domain and its associated IP address, 188.114.96.3, to prevent further incidents.