info-hourglass[.]com

This domain, info-hourglass.com, operates as a credential harvesting site designed to steal user login information through fraudulent login portals. Analysis indicates the site employs deceptive techniques, including fake authentication prompts and redirects, to trick visitors into submitting sensitive data such as usernames, passwords, and potentially multi-factor authentication codes. The infrastructure is structured to mimic legitimate services, increasing the likelihood of successful deception against unsuspecting users. Infrastructure analysis reveals the domain was registered on November 10, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.89.165 and has been flagged by 1 out of 95 security vendors on VirusTotal, with additional detections by two independent security blocklists. The page title, 'Nur einen Moment…,' suggests the use of German-language lures or a redirect mechanism to delay user recognition of the fraudulent nature of the site. Users who visited info-hourglass.com should immediately revoke any entered credentials, particularly for financial, email, or corporate accounts. Enable multi-factor authentication on all critical services and monitor accounts for unauthorized activity. If financial data was submitted, contact the relevant institution to report potential fraud. Network administrators should block the domain and its resolving IP (104.21.89.165) at the perimeter level to prevent further exposure. The domain’s current offline status does not eliminate risk, as threat actors may reactivate it or reuse the infrastructure for future campaigns.