creatorka[.]ai

This domain, creatorka.ai, is actively engaged in credential theft phishing operations targeting users through deceptive login portals. Analysis indicates the site mimics legitimate authentication interfaces to harvest usernames, passwords, and potentially multi-factor authentication tokens. The threat extends to corporate and personal accounts, with a focus on cloud services, email providers, and financial platforms, increasing the risk of account takeovers and subsequent data breaches. Infrastructure analysis reveals the domain was registered on November 28, 2025, through GoDaddy.com, LLC, and resolves to the IP address 91.99.129.73, hosted on AS24940 (Hetzner Online GmbH) in Germany. The domain is flagged by 4 out of 95 security vendors on VirusTotal, and appears on one security blocklist. The SSL certificate, issued by Let's Encrypt (serial number E7), suggests automated deployment, a common tactic in phishing campaigns to lend a false sense of legitimacy. The domain remains active despite partial detection, indicating ongoing malicious activity. Users who have visited creatorka.ai or entered credentials on the site should immediately revoke any active sessions, reset passwords for all potentially compromised accounts, and enable multi-factor authentication where available. Network administrators are advised to block the domain and its resolving IP (91.99.129.73) at the perimeter. Monitor for unusual login attempts or unauthorized access, particularly to cloud-based services. If financial or sensitive data was entered, initiate fraud alerts with relevant institutions and consider credit monitoring services. The domain's recent creation date and low detection rate underscore the need for heightened vigilance.