andafpro[.]vip

This domain, andafpro.vip, is actively engaged in credential harvesting phishing operations targeting users through deceptive login interfaces. Analysis indicates the site mimics legitimate authentication portals to capture sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. The domain presents itself under the page title 'ANDAF,' which may be used to impersonate a trusted service or platform, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain was registered on April 26, 2026, through Gname.com Pte. Ltd., and currently resolves to the IP address 172.67.162.237, hosted under Cloudflare, Inc. (AS13335). Security vendor detections on VirusTotal show 6 out of 95 engines flagging the domain as malicious. Additionally, the domain appears on three distinct security blocklists and is actively blocked by multiple reputation-based security mechanisms. The SSL certificate, issued by Let's Encrypt, does not mitigate the threat, as encrypted phishing sites are now commonplace. Users who have visited andafpro.vip or entered credentials on the site should immediately revoke any exposed login details from all associated accounts. Multi-factor authentication tokens or recovery codes used on the site should be considered compromised and reset. Network administrators are advised to block the domain and its resolving IP at the perimeter level. Endpoints that accessed the domain should undergo forensic analysis to detect potential follow-up malware or unauthorized access attempts. Continuous monitoring for unusual authentication activity is recommended for at least 30 days following exposure.