spgrlimited[.]com

This domain, spgrlimited.com, has been identified as a confirmed fake login portal designed to harvest user credentials under the guise of financial service authentication. Analysis indicates the site was operational as a phishing endpoint targeting customers of major banking and payment platforms, though it is currently offline. No specific brand name was embedded in the page title or visible content, but the infrastructure and detected technologies align with credential-theft campaigns commonly used against financial institutions. Infrastructure analysis reveals the domain was registered on May 30, 2023, through OwnRegistrar, Inc., and resolved to the IP address 147.124.214.22. The site was built using WordPress, MySQL, PHP, Bootstrap, LiteSpeed, Swiper, jQuery Migrate, and jQuery, a technology stack consistent with rapidly deployed phishing kits. Detection metrics show the domain was flagged by 2 of 95 security vendors on VirusTotal and appears on one security blocklist. The page title, consisting solely of the letter 'S,' suggests minimal effort to evade automated detection or may indicate an incomplete deployment. Current status indicates the domain has been taken offline, though residual risk remains due to potential DNS caching or delayed blocklist propagation. Organizations are advised to add spgrlimited.com to internal blocklists and monitor for any re-emergence on new IP addresses or subdomains. Network defenders should inspect logs for connections to 147.124.214.22 and the domain’s registration details for signs of compromise. End users who may have interacted with the site should be instructed to reset credentials on any financial accounts accessed during the exposure window, particularly if multi-factor authentication was not enabled. Proactive threat hunting for related infrastructure, such as domains registered via OwnRegistrar, Inc., during the same timeframe is recommended to identify potential follow-on campaigns.