netzero-107559[.]square[.]site

This domain, netzero-107559.square.site, operates as a fake login portal designed to harvest user credentials through deceptive authentication interfaces. Analysis indicates the page title 'Nur einen Moment…' is used to simulate a loading or verification process, a common tactic to lower user suspicion while capturing entered credentials. The threat aligns with patterns observed in credential phishing campaigns targeting users of legitimate services, where attackers replicate login workflows to trick victims into disclosing sensitive information. Infrastructure analysis reveals the domain was registered on February 21, 2026, through MarkMonitor, Inc., a registrar frequently associated with both legitimate and malicious domains. The domain resolves to the IP address 74.115.51.4, hosted under AS27647 (Weebly, Inc.), a provider commonly leveraged for rapid deployment of phishing pages. Detection metrics indicate 17 out of 95 security vendors on VirusTotal have flagged the domain as malicious, while two independent blocklists—PhishDestroy and PhishingDB—have actively listed it. The SSL certificate, issued by Let’s Encrypt (serial number E7), provides encrypted connections, further masking the fraudulent nature of the site from casual inspection. Users who have visited netzero-107559.square.site or entered credentials on the page should immediately revoke access to any accounts associated with the submitted information. Passwords for affected accounts must be changed using a secure, unrelated device, and multi-factor authentication should be enabled where available. System scans using updated security tools are recommended to detect potential secondary infections. Organizations should block the domain and its resolving IP (74.115.51.4) at the network perimeter to prevent further exposure. Monitoring for unauthorized access or anomalous activity in linked accounts is critical, as harvested credentials may be exploited in follow-up attacks.