connect-0x02747608c686[.]com

Analysis of the domain connect-0x02747608c686.com, observed on July 24, 2026, indicates that it is being used for a generic phishing campaign. The site is currently offline, and its page title was reported as “Plesk Obsidian 18.0.74,” suggesting the underlying hosting panel rather than a legitimate brand. The domain was registered on January 4, 2026 through Realtime Register B.V. and resolves to the IPv4 address 193.143.1.148, which is allocated to AS198953 Proton66 OOO in Russia. The SSL certificate presented is identified as R13, a low‑trust certificate often associated with malicious infrastructure.

Reputation services assign extremely low trust scores: Scamadviser rates the domain 1/100 and Gridinsoft 0/100. The domain appears on a single security blocklist, specifically PhishDestroy, and has been referenced in one AlienVault OTX pulse. VirusTotal records show that 14 of 93 scanners flagged the domain, reinforcing the suspicion of malicious activity. The risk level is classified as elevated.

While the offline status limits immediate observation of the payload, the combination of a recent registration, Russian hosting, low trust scores, and multiple vendor detections provides a strong indicator of phishing intent. Uncertainty remains regarding the specific phishing template or targeted victims, as no additional content analysis is available. Defenders should block the domain at network perimeter, update URL filtering and DNS sinkhole rules, and monitor for any traffic to 193.143.1.148. Incident response teams should also consider correlating logs for similar domains registered through the same registrar or hosted in the same ASN, and incorporate the domain into threat‑intel feeds to improve detection across security products.