unlockeduser[.]com[.]psnuser[.]com

Analysis of the domain www.unlockeduser.com.psnuser.com confirms its classification as an active credential-harvesting phishing site targeting PlayStation Network users. The domain, registered on March 11, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, currently resolves to the IP address 79.133.41.250, which is geolocated in Germany and associated with AS214036 (Ultahost, Inc.). Infrastructure analysis reveals the use of Nginx and OpenResty web server technologies, alongside nameservers ns1.ultahost.com through ns4.ultahost.com, indicating centralized hosting under the same provider. The site presents an HTTP 200 status with a deceptive page title, 'One moment, please...', a common tactic to delay or mislead users while background scripts execute. Detection metrics indicate moderate but consistent flagging: five out of ninety-five security vendors on VirusTotal have identified the domain as malicious, while a single security blocklist has included it. The SSL certificate, issued by Let's Encrypt (R12), provides encryption but does not validate legitimacy, as phishing sites routinely leverage free certificates to appear trustworthy. While the exact phishing kit or payload remains unconfirmed, the subdomain structure—mimicking PlayStation Network branding—strongly suggests an intent to harvest login credentials or payment details. The domain's creation four months prior to this report aligns with typical phishing campaign lifecycles, where attackers pre-register infrastructure before activation. Defenders should treat this domain as high-risk and implement immediate blocking at the DNS or network level. Organizations are advised to monitor for connections to 79.133.41.250 and review logs for any interaction with the domain, particularly from endpoints associated with gaming or entertainment services.