caracolsida[.]org

The domain caracolsida.org is a confirmed phishing site engaged in brand impersonation targeting Amazon users. It presents itself as a legitimate Amazon login portal to harvest credentials but does not deploy a crypto drainer kit. As of the latest verification, caracolsida.org has been taken offline, though it previously posed an elevated risk of credential theft through deceptive login pages.

Technical indicators show caracolsida.org was flagged by 1 of 95 VirusTotal security vendors, including Gridinsoft, which assigned a trust score of 0/100. The domain appears on 1 security blocklist (PhishDestroy) and was registered through NameCheap, Inc. on April 16, 2025. It resolved to the IP address 199.188.201.56, hosted on AS22612 (Namecheap, Inc.) in the US, with no SSL certificate issued. The observed page title was 'MAXWIN5000 - Di Rancang Untuk Di Akses Semua Kalangan Dengan Mudah 2025', and the domain used a single nameserver.

Victims who interacted with caracolsida.org should immediately change their Amazon passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized purchases or password reset attempts. Report the phishing domain to Amazon via their official reporting channels and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in takedown efforts.