web-venchiors[.]lol

Analysis of web-venchiors.lol indicates a confirmed phishing infrastructure targeting system administrators through a spoofed Plesk Obsidian 18.0.70 control panel interface. The domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently offline following takedown actions. Infrastructure reveals nameservers ns1.verification-hold.suspended-domain.com and ns2.verification-hold.suspended-domain.com, a pattern consistent with suspended or abused hosting accounts. The site resolved to IP 216.126.236.14 (AS14956, RouterHosting LLC, US), a network previously associated with malicious activity. An SSL certificate (R10) was present, though its validity or issuer details remain unconfirmed.

Detection data shows the domain appears on one security blocklist and is flagged by PhishDestroy. VirusTotal reports two security vendors identifying this domain as malicious, though the specific detection rules or payloads are not disclosed. The page title, Plesk Obsidian 18.0.70, directly suggests an attempt to impersonate legitimate Plesk administration panels, likely aiming to harvest credentials or deploy malware on compromised servers. No specific brand impersonation beyond Plesk is confirmed from available evidence.

Defenders should treat this domain as high-risk for credential theft and server compromise. Recommended actions include blocking the domain and IP at perimeter security controls, reviewing logs for connections to 216.126.236.14 between February and July 2026, and alerting IT staff to potential Plesk-themed phishing attempts. The suspended nameserver pattern may indicate broader abuse of the same registrar or hosting provider; cross-referencing with other domains using verification-hold.suspended-domain.com nameservers could reveal related threats. No evidence currently links this domain to broader phishing kits or campaigns beyond the Plesk impersonation.