phase3[.]rootdiamonds[.]com

This domain, phase3.rootdiamonds.com, is identified as a credential theft operation designed to deceive users into submitting login credentials, financial details, or other sensitive information through fraudulent web forms. Analysis indicates the site mimics legitimate services to trick visitors into disclosing personal or corporate data, which may then be exploited for unauthorized access, financial fraud, or further cyberattacks. The infrastructure appears tailored to evade casual detection while targeting users who may be redirected via malicious links in emails, ads, or compromised websites. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Tucows Domains Inc., a detail that may aid in tracking related malicious activity. At the time of assessment, 13 out of 95 security vendors on VirusTotal flagged the domain as malicious, indicating a moderate but concerning level of detection. The domain resolved to the IP address 108.167.158.3, hosted on infrastructure belonging to Oracle Corporation (AS31898) in the United States. The SSL certificate, identified as R13, suggests the use of automated or low-cost encryption, a common tactic among threat actors to lend superficial legitimacy to phishing sites. The domain has since been taken offline, but its prior activity and registration details remain relevant for historical threat correlation. Users who visited phase3.rootdiamonds.com or entered credentials on any site resembling its infrastructure should take immediate action to mitigate potential risks. First, reset passwords for any accounts accessed from the same device or network during the exposure window, prioritizing email, financial, and work-related platforms. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized transactions, login attempts, or suspicious communications, and report any anomalies to the respective service providers. If corporate or sensitive data was entered, notify internal security teams or relevant authorities to assess the scope of potential compromise. Finally, scan the device used to access the domain for malware or unauthorized software, as phishing sites often deploy secondary payloads to maintain persistence.