arnland-secure-drop[.]online

The domain arnland-secure-drop.online is confirmed to host a credential theft operation targeting users of secure file-sharing platforms. Analysis indicates the site mimics legitimate services to deceive victims into submitting login credentials, which are then harvested for unauthorized access. The page title 'Site en construction' suggests an attempt to appear as an inactive or legitimate under-construction page, a common tactic to evade initial suspicion. Infrastructure analysis reveals the domain was registered on March 06, 2026, through OVH, SAS, and currently resolves to the IP address 213.186.33.5. It has been flagged by 3 of 95 security vendors on VirusTotal and appears on three independent security blocklists. The domain is also blocked by multiple browser-based security extensions, further indicating its malicious nature. The creation date and hosting provider align with patterns observed in credential theft campaigns, where newly registered domains are rapidly deployed to avoid detection. As of the latest assessment, arnland-secure-drop.online has been taken offline, though the infrastructure may be reactivated under a new domain or IP. Organizations and users are advised to block the domain and its associated IP at the network level. Security teams should monitor for similar domains registered through OVH or resolving to 213.186.33.5, as these may represent follow-up campaigns. Users who interacted with the site should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available.