postmaster[.]connexion-client[.]com

This domain, postmaster.connexion-client.com, is known to pose a specific threat of credential theft. The domain impersonates a legitimate Plesk Obsidian 18.0.73 server to trick users into disclosing sensitive information such as usernames, passwords, and other credentials.

Analysis indicates that the domain has been flagged by 14 out of 95 security vendors on VirusTotal, highlighting a significant level of suspicion. The domain was registered through Hosting Concepts B.V. d/b/a Registrar.eu on October 31, 2025, and currently resolves to the IP address 141.11.136.50, which is located in the United States and is associated with AS25693 Virtual Machine Solutions LLC. The domain appears on one security blocklist and was taken offline, likely due to detection and intervention by security services. The SSL certificate used by the domain is issued by Let's Encrypt / R12, a common practice among phishing actors to gain user trust.

If users have visited this domain, they should immediately change their passwords for any accounts they may have entered credentials into, especially those related to Plesk or other administrative interfaces. Additionally, users should run a comprehensive security scan on their systems to detect any potential malware that may have been installed. It is also recommended to monitor account activity for any unusual or unauthorized actions.