petropolisclub[.]com

This domain, petropolisclub.com, is a confirmed phishing site designed to mimic Microsoft OneDrive login pages with the intent to harvest user credentials. Analysis of the page title, which explicitly displays 'One Drive,' indicates a targeted effort to deceive victims into entering sensitive account information under the false pretense of accessing cloud storage services. The domain employs social engineering tactics, a threat type explicitly flagged by Google Safe Browsing, to exploit user trust in familiar platforms and bypass initial suspicion. Infrastructure analysis reveals multiple high-confidence indicators supporting the malicious classification of petropolisclub.com. The domain is flagged by 10 out of 95 security vendors on VirusTotal, demonstrating broad consensus among threat intelligence sources. It appears on two independent security blocklists and is actively blocked by at least two DNS-based threat prevention systems. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on August 07, 2006, though the creation date does not align with typical benign use for this type of service. It resolves to the IP address 162.215.253.9, which has been associated with other phishing campaigns in recent months. The SSL certificate, issued by Let's Encrypt, is commonly used by both legitimate and malicious sites, providing minimal assurance of authenticity. Users who visited petropolisclub.com or entered credentials on any page hosted under this domain should take immediate action to mitigate potential account compromise. All passwords entered on the site must be changed from a secure device, prioritizing accounts with access to sensitive data or financial information. Enable multi-factor authentication where available to prevent unauthorized access. Monitor linked accounts for unusual activity, including unauthorized logins, password reset attempts, or unfamiliar transactions. If the affected device was used to access corporate or institutional resources, report the incident to the appropriate security team for further investigation and containment. The domain has been taken offline, but users should remain vigilant for similar phishing attempts using comparable infrastructure or branding.