dolvax[.]casa

This domain, dolvax.casa, is identified as a credential theft operation designed to harvest user login credentials through a deceptive interface. The site impersonates the 'Energen - Free Bootstrap 4 Template by Colorlib,' a legitimate web template, to lend credibility to its fraudulent login portal. Analysis indicates the domain targets unsuspecting users by mimicking a trusted design, likely prompting them to enter sensitive information such as usernames, passwords, or other authentication details, which are then captured by the threat actors for malicious use. Infrastructure analysis reveals multiple indicators of compromise. The domain was registered on May 20, 2026, through Sav.com LLC, an unusually future-dated creation that may suggest domain spoofing or registry manipulation. It resolves to the IP address 185.221.216.121, hosted in the United Kingdom under the provider Mdnhd Private. Security vendors on VirusTotal flagged the domain at a rate of 19/95, indicating moderate to high confidence in its malicious nature. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (R12), does not mitigate the risk due to the domain's fraudulent intent. Users who visited dolvax.casa should take immediate remediation steps. If any credentials were entered on the site, reset passwords for all accounts where the same or similar credentials may have been reused. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized activity, such as logins from unfamiliar locations or devices. Consider running a full antivirus scan to detect any secondary infections that may have been introduced. Finally, report the domain to local cybersecurity authorities or incident response teams to aid in broader threat mitigation efforts.