ketuatoto[.]cc

This domain, ketuatoto.cc, is actively engaged in credential harvesting under the guise of a California-based bakery, "Academy Bakery." The site presents a fabricated storefront with the page title "KETUATOTO : Academy Bakery In California Puff Pastries" to deceive visitors into entering sensitive login credentials or personal information. Analysis indicates the domain is designed to mimic legitimate small businesses, increasing the likelihood of successful social engineering attacks against unsuspecting users seeking local services or products. Infrastructure analysis reveals multiple high-risk indicators. The domain is flagged by 17 out of 95 security vendors on VirusTotal, with one confirmed blocklist entry (PhishDestroy). It was registered on May 28, 2026, through NAMECHEAP INC, a registrar frequently associated with malicious domains. The site resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.), which is commonly used to obfuscate the true origin of phishing infrastructure. The SSL certificate, issued by Let's Encrypt (serial number E8), further suggests an attempt to appear legitimate while masking its fraudulent intent. Users who have visited ketuatoto.cc or interacted with its content should take immediate action to mitigate risk. Any credentials entered on the site must be considered compromised and should be changed across all platforms where the same or similar passwords were used. Browser data, including cookies and cached files, should be cleared to remove any residual tracking mechanisms. Organizations should update their web filtering rules to block the domain and its resolving IP address. If financial or personally identifiable information was submitted, affected individuals should monitor accounts for unauthorized activity and report the incident to relevant authorities or fraud response teams.