test[.]chohantextile[.]com

This domain, test.chohantextile.com, is flagged for elevated-risk credential theft targeting Raiffeisen Bank customers. Analysis indicates a targeted impersonation of the bank’s login portal, specifically the Hungarian-language interface ('Raiffeisen BANK - Belépés'), designed to harvest account credentials for unauthorized access to financial systems. The threat type is classified as credential theft, with no indicators of cryptocurrency drainer or malware distribution activity associated with this campaign. Infrastructure analysis reveals the domain was registered on April 11, 2020, through IONOS SE, a registrar frequently observed in phishing operations. It resolves to the IP address 5.144.130.187, which has been linked to prior fraudulent activity. The SSL certificate is issued by Sectigo Limited, providing a superficial layer of legitimacy while failing to mitigate the underlying malicious intent. Detection metrics include 6 out of 95 security vendors flagging the domain on VirusTotal, with additional listings on three security blocklists. Technologies detected on the server include PHP and LiteSpeed, commonly exploited in phishing kits for dynamic content delivery and evasion of basic detection mechanisms. Mitigation of this credential theft threat requires immediate action from both financial institutions and end-users. Raiffeisen Bank should issue targeted alerts to customers, emphasizing the fraudulent nature of the domain and advising against any interaction with the site. Network-level blocking of the IP address 5.144.130.187 and domain test.chohantextile.com is recommended for organizations to prevent access. End-users are advised to verify the authenticity of banking portals by cross-referencing official URLs and enabling multi-factor authentication (MFA) to neutralize the impact of stolen credentials. Monitoring for unauthorized transactions and reporting suspicious login attempts to the bank’s fraud department are critical steps in mitigating post-compromise risks.