ooteeweuyuweh293892dhu2[.]fly[.]dev

This domain, ooteeweuyuweh293892dhu2.fly.dev, operates as a credential theft site designed to harvest sensitive login information by impersonating official documentation portals. Analysis of the page title, 'Official Documents,' indicates an attempt to deceive users into submitting credentials under the guise of legitimate administrative or corporate materials. The site employs social engineering tactics to exploit trust in institutional communications, likely targeting employees, contractors, or individuals handling confidential data. Infrastructure analysis reveals the domain was registered through Fly on March 14, 2026, and resolves to the IP address 66.241.125.152, hosted under AS40509 (Fly.io, Inc.) in the United States. The domain appears on one security blocklist and is flagged as phishing by Google Safe Browsing. VirusTotal detection metrics show 21 out of 95 security vendors have classified this domain as malicious, with the SSL certificate issued by Let's Encrypt (serial number E8). The domain remains active as of this report, indicating ongoing operational status. Users who have visited ooteeweuyuweh293892dhu2.fly.dev should immediately revoke any credentials entered on the site and monitor associated accounts for unauthorized activity. Network administrators are advised to block the domain and its resolving IP (66.241.125.152) at the perimeter. Affected systems should undergo a security review to detect potential malware or persistent threats. If financial or personally identifiable information was submitted, users should follow incident response protocols for data breach mitigation, including notifying relevant authorities and implementing credit monitoring where applicable.