onesignalmdb[.]modobomz[.]com

This domain, onesignalmdb.modobomz.com, is identified as a credential theft operation targeting developers through a fake Laravel framework interface. Analysis indicates the site was designed to harvest login credentials, API keys, or other sensitive authentication details by mimicking legitimate Laravel web portals. The infrastructure shows signs of deliberate impersonation of developer tools, a tactic commonly used to exploit trust in widely adopted software ecosystems. Infrastructure analysis reveals the domain was registered on February 27, 2024, through GoDaddy.com, LLC, and resolved to the IP address 188.114.97.3. It was flagged by 16 out of 95 security vendors on VirusTotal and appeared on two independent security blocklists, including PhishDestroy and Maltrail. The page title was explicitly set to 'Laravel,' further confirming its intent to deceive users familiar with the framework. The SSL certificate was issued by Google Trust Services, a detail often exploited to lend false legitimacy to malicious sites. Users who visited onesignalmdb.modobomz.com should immediately revoke any credentials entered on the site, particularly those associated with Laravel projects, cloud services, or version control systems. Monitor accounts for unauthorized access or anomalous activity, and rotate API keys or tokens linked to the compromised credentials. If the site was accessed in a corporate or development environment, report the incident to internal security teams for further investigation and containment. Given the domain's current offline status, no immediate threat remains, but residual risks from exposed credentials persist.