handala[.]red

This domain, handala.red, is identified as a credential theft phishing site targeting users through social engineering tactics. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, but the domain’s infrastructure and blocklist presence align with broad credential harvesting operations. The site appears designed to deceive users into submitting login credentials, likely for financial or personal data exploitation. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com. It resolves to the IP address 192.142.53.75 and is flagged by 17 out of 95 security vendors on VirusTotal. Google Safe Browsing classifies the domain under the SOCIAL_ENGINEERING category, and it appears on two security blocklists. Additional threat intelligence sources, including AlienVault OTX, have documented the domain in at least one threat pulse, further corroborating its malicious classification. The domain is currently offline, having been taken down following detection by multiple security providers, including PhishDestroy and InversionDNS. While the immediate threat has been mitigated, residual risk remains due to the domain’s recent registration and prior association with credential theft campaigns. Organizations are advised to monitor for re-activation attempts and implement proactive blocking of the domain and its resolving IP in security controls. Users should be educated on recognizing social engineering tactics, particularly those mimicking login portals or urgent account verification requests.