centralgestaototal[.]online

This domain, centralgestaototal.online, is an active credential theft operation designed to harvest corporate login credentials. Analysis indicates the site presents itself as a legitimate enterprise portal, tricking users into entering usernames, passwords, and potentially multi-factor authentication codes. The threat extends beyond individual accounts, as compromised credentials could enable lateral movement within corporate networks, data exfiltration, or deployment of additional malware payloads. The site may also serve as a staging ground for follow-up attacks, including business email compromise or targeted spear-phishing campaigns against an organization's contacts. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on June 30, 2026, through Dynadot Inc, with a suspiciously future creation date suggesting an attempt to evade reputation-based filters. It resolves to IP address 69.49.241.129 and uses a Let's Encrypt SSL certificate, a common tactic to appear legitimate while encrypting stolen data in transit. VirusTotal detection shows 2 out of 95 security vendors currently flag the domain, a low but significant ratio that often precedes broader detection as the campaign evolves. The domain name itself, combining generic corporate terms like 'central' and 'gestao,' aligns with patterns observed in enterprise impersonation schemes. Users who have visited centralgestaototal.online or entered credentials on the site should take immediate action. First, revoke any sessions associated with the affected account and reset passwords using a secure, unrelated device. Enable multi-factor authentication if not already active, prioritizing app-based or hardware tokens over SMS-based methods. Monitor the account for unauthorized activity, including login attempts, email forwarding rules, or changes to security settings. If corporate credentials were exposed, report the incident to internal security teams for enterprise-wide remediation, which may include forced password resets, network segmentation reviews, or endpoint scans. Finally, check connected services (e.g., cloud storage, third-party apps) for signs of unauthorized access, as attackers often exploit compromised credentials to pivot to other systems.