dinodrokp[.]com

This domain, dinodrokp.com, is identified as a credential harvesting phishing site designed to mimic legitimate financial institutions. Analysis indicates the infrastructure was engineered to deceive users into submitting sensitive authentication details, including usernames, passwords, and multi-factor authentication codes. The site employed social engineering tactics, such as spoofed login pages and urgency-driven messaging, to exploit victims during the brief period it was operational. Infrastructure analysis reveals dinodrokp.com was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolved to the IP address 104.21.60.245, a Cloudflare proxy endpoint commonly used to obfuscate malicious infrastructure. At the time of assessment, 6 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appeared on one security blocklist. AlienVault OTX recorded the domain in a single threat intelligence pulse, suggesting limited but targeted distribution. Users who visited dinodrokp.com or interacted with its content should immediately revoke any submitted credentials, particularly for financial or email accounts. Monitor linked accounts for unauthorized transactions or access attempts, and enable multi-factor authentication where available. Organizations should update endpoint protection rules to block the domain and its associated IP address (104.21.60.245) at the network perimeter. Given the domain's current offline status, further compromise attempts are unlikely, but vigilance is advised for similar phishing campaigns using the same registrar or hosting patterns.