felaro[.]sbs

This domain, felaro.sbs, is flagged as a generic phishing site designed to impersonate a legitimate Plesk Obsidian login portal. Analysis indicates the site likely functions as a credential harvester, targeting system administrators, web hosting clients, or IT personnel who may mistake it for an authentic control panel interface. The presence of a Plesk-themed page title and SSL certificate suggests an attempt to deceive users into entering sensitive login credentials, which could then be exploited for unauthorized access to hosting environments, email accounts, or backend systems. Such attacks often lead to further compromise, including data exfiltration, malware deployment, or lateral movement within a network. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on December 04, 2025, through Dynadot LLC, a registrar frequently abused for phishing operations. It resolves to the IP address 46.151.182.165, hosted under AS205759 (Ghosty Networks LLC) in Luxembourg, a network segment with a history of hosting fraudulent infrastructure. Security vendors on VirusTotal flagged the domain at a rate of 17 out of 95, with detection labels including phishing, credential theft, and fraudulent login portal. Additionally, the domain appears on one security blocklist and is actively blocked by enterprise phishing protection systems, further corroborating its malicious classification. Users who visited felaro.sbs should take immediate remedial actions to mitigate potential risk. If any credentials were entered on the site, those credentials must be changed immediately across all platforms where they were reused, prioritizing administrative or privileged accounts. System administrators should review authentication logs for unusual access patterns or failed login attempts originating from their networks. Devices used to access the site should undergo a full security scan to detect any secondary payloads or persistent threats. Organizations are advised to implement multi-factor authentication (MFA) for all critical systems and enforce strict domain validation policies to prevent similar incidents. Monitoring for phishing-related indicators, such as the IP address 46.151.182.165 or SSL certificates issued to Plesk on unexpected domains, can help detect ongoing or future campaigns.