andafpro[.]com

The domain andafpro.com is identified as a credential harvesting phishing infrastructure targeting users through deceptive login portals. Analysis indicates the domain is currently offline, though it previously hosted content with the page title 'FACKJX,' a non-standard identifier often associated with obfuscated phishing kits. No specific brand impersonation was confirmed, but the domain exhibits characteristics consistent with generic credential theft campaigns, including the use of automated phishing frameworks. Infrastructure analysis reveals the domain was registered through Name SRS AB on April 26, 2026, and resolved to the IP address 188.114.96.3. Security vendors on VirusTotal flagged the domain, with 5 of 95 engines detecting malicious activity. The domain appears on three security blocklists, and AlienVault OTX includes it in at least one threat intelligence pulse. The SSL certificate, issued by Let's Encrypt (serial number E7), suggests the use of automated certificate provisioning, a common tactic in phishing operations to lend superficial legitimacy to fraudulent sites. As of the latest assessment, andafpro.com is offline, reducing immediate exposure risk. However, the domain's registration remains active, and historical patterns indicate potential for reactivation. Organizations and users are advised to block the domain and its associated IP (188.114.96.3) at the network level. Security teams should monitor for references to the page title 'FACKJX' in logs, as it may indicate compromise attempts. End-users who accessed the domain should reset credentials for any accounts entered on the site and enable multi-factor authentication where available. Proactive threat hunting for related indicators, such as the registrar (Name SRS AB) or SSL certificate serial (E7), is recommended to identify additional malicious infrastructure.