matloc-adres[.]com

PhishDestroy identifies matloc-adres.com as an active credential theft domain under investigation for deceptive practices targeting unsuspecting users. The domain employs brand impersonation tactics to harvest login credentials, posing a significant risk to individuals and organizations alike. Security teams must treat this domain as a high-priority threat due to its active status and potential for widespread exploitation. This domain was flagged with a risk level of 'under_investigation' and exhibits multiple red flags consistent with credential theft campaigns. Domain creation occurred on April 29, 2026, with registration facilitated by NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to IP address 188.114.97.3 and utilizes a Let's Encrypt SSL certificate, which may lend an air of legitimacy to its fraudulent activities. VirusTotal currently reports 0 detections out of 95 engines, indicating it has not yet been widely blacklisted despite its active nature. The absence of detections should not be interpreted as a sign of safety, as threat actors frequently exploit gaps in detection coverage to prolong their operations. Mitigation for this credential theft threat requires immediate action to prevent further compromise. Organizations and individuals should block the domain matloc-adres.com and its associated IP address 188.114.97.3 at the network level to halt any ongoing credential harvesting attempts. Additionally, users should be instructed to verify the authenticity of websites before entering login credentials, with a preference for multi-factor authentication (MFA) to add an extra layer of security. Security teams are advised to monitor for any related domains or infrastructure changes, as threat actors often rotate resources to evade detection. Report any observed activity involving this domain to relevant cybersecurity authorities to aid in broader threat intelligence sharing.