ggdrup[.]com

This domain, ggdrup.com, is confirmed to operate as a credential theft phishing site designed to harvest login credentials for financial services, including banking and payment platforms. Analysis indicates the infrastructure was engineered to mimic legitimate financial portals, tricking users into entering sensitive authentication details. The domain exhibits characteristics typical of large-scale credential harvesting campaigns, including the use of obfuscated scripts and form submissions to exfiltrate data to attacker-controlled servers. Infrastructure analysis reveals ggdrup.com was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolved to the IP address 172.67.149.186 and was flagged by 7 out of 95 security vendors on VirusTotal, indicating moderate to high detection rates. Additionally, the domain appears on one security blocklist and was referenced in a single AlienVault OTX threat intelligence pulse, further corroborating its malicious intent. The site is currently offline, suggesting either takedown action or operational cessation by the threat actors. Users who visited ggdrup.com or entered credentials on the site should assume their login details have been compromised. Immediate action is required, including resetting passwords for any financial or sensitive accounts accessed from the same device. Multi-factor authentication (MFA) should be enabled where available to mitigate unauthorized access. Devices used to visit the domain should undergo a full security scan to detect potential malware or backdoors. Network-level monitoring is advised to identify any suspicious outbound connections to the IP 172.67.149.186 or related infrastructure. Organizations should update their blocklists to include this domain and its associated indicators to prevent future exposure.