brits-accessoriesmerchant[.]com

Analysis of the domain brits-accessoriesmerchant.com indicates it was established as a generic phishing site targeting retail customers. The domain was registered on February 27, 2026, through NiceNIC International Group Co., Limited and resolved to the IP address 193.111.117.145, hosted on AS207043 (DEDIK SERVICES LIMITED) in Poland. Nameservers were configured under Cloudflare (amy.ns.cloudflare.com and quincy.ns.cloudflare.com), a common tactic to obscure hosting origins and evade initial detection. No SSL certificate was present, increasing the likelihood of plaintext credential harvesting.

The page title, 'brits-accessoriesmerchant.com/', suggests an attempt to mimic a legitimate accessories or retail merchant, though the exact brand or product focus remains unconfirmed due to limited content analysis. Detection data shows the domain was flagged by one security blocklist (PhishDestroy) and was identified by 3 of 93 security vendors on VirusTotal, indicating moderate but not widespread recognition as malicious. The domain has since been taken offline, though historical resolution and registration details remain relevant for retrospective threat hunting.

Defenders should treat any prior connections to 193.111.117.145 or the domain itself as indicators of compromise, particularly in retail or e-commerce contexts. No evidence links this domain to a known phishing kit or specific campaign, and further analysis of captured payloads or redirect chains is required to determine the full scope of the threat. The absence of SSL and the use of Cloudflare nameservers are consistent with low-effort phishing infrastructure, but the domain's short active period limits available forensic data.