epiclocker[.]net

This domain, epiclocker.net, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials, financial details, or personal information. The site employs a deceptive page titled 'Loading,' a common tactic to mimic legitimate service initialization while capturing user input in real time. Analysis indicates the domain is part of a broader phishing infrastructure targeting individuals through fraudulent notifications, fake login portals, or spoofed service prompts. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on May 27, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with malicious registrations. It resolves to the IP address 91.227.114.14, a host previously linked to other phishing campaigns. Detection metrics confirm its malicious status: 9 out of 95 security vendors on VirusTotal flag the domain as phishing-related, and it appears on at least one security blocklist. The SSL certificate, issued by Let's Encrypt (serial number E7), provides HTTPS encryption, further lending an illusion of legitimacy to unsuspecting visitors. Users who accessed epiclocker.net should immediately cease all interaction and assume their credentials or personal data may have been compromised. It is recommended to change passwords for any accounts entered on the site, particularly those linked to financial services, email, or corporate systems. Monitor accounts for unauthorized transactions or activity, and enable multi-factor authentication where available. System scans using updated security tools are advised to detect potential malware or follow-up phishing attempts. Network administrators should block the domain and its associated IP (91.227.114.14) at the perimeter to prevent further exposure.