shirim[.]co[.]il

This domain, shirim.co.il, is actively serving a credential phishing page designed to mimic an account verification process. The page title 'Confirm Your Account' is a common social-engineering tactic used to induce users into submitting login credentials or personal information. Analysis indicates the domain has been flagged by 15 out of 95 security vendors on VirusTotal, with detections spanning multiple threat intelligence sources, including 15 pulses in AlienVault OTX. The domain is also present on two security blocklists, specifically PhishDestroy and BLP-Malware, further corroborating its malicious classification. Infrastructure analysis reveals the domain is registered through Drubit Raid LTD and resolves to the IP address 185.56.74.17. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. While the certificate itself does not indicate malicious intent, its presence does not mitigate the domain's confirmed phishing activity. The Gridinsoft trust score of 0/100 aligns with the high-risk assessment, reflecting consistent detection across multiple security platforms. What remains uncertain is the specific brand or service being impersonated, as the available data does not include details about the phishing kit or targeted organization. However, the use of a generic 'Confirm Your Account' page title suggests broad targeting rather than a tailored campaign against a single entity. Defenders should treat this domain as an active threat and implement blocking measures at the network and endpoint levels. Monitoring for connections to the IP address 185.56.74.17 or domains registered through Drubit Raid LTD may help identify related malicious activity. Given the domain's persistence and cross-platform detection, it is recommended to classify this as a high-confidence phishing indicator.