secret[.]tunnel[.]thecircleplatform[.]org

PhishDestroy identifies the domain secret.tunnel.thecircleplatform.org as a credential theft page impersonating the Circle Admin portal. This domain remains active and was created on October 02, 2025 through NAMECHEAP INC. Currently, it is not flagged by any of the 95 VirusTotal scanning vendors and resolves to IP address 66.241.125.240. The page title displayed is Circle Admin and it holds a valid Let’s Encrypt SSL certificate, suggesting an attempt to appear legitimate. Despite zero detections on VirusTotal, this domain has been placed under active investigation due to strong indicators of credential theft behavior. The hosting infrastructure and registration details—including the recent creation date and use of a free SSL certificate—are typical of short-lived phishing operations designed to harvest user login details. Users are strongly advised to avoid accessing this domain or entering any credentials. Organizations should block this domain at the network level and update their threat intelligence feeds accordingly. Report any accidental exposure to your security team immediately and consider rotating exposed credentials using a secure, offline process.