webrat[.]top

This domain, webrat.top, is identified as a credential harvesting phishing site designed to capture user login credentials through fraudulent web interfaces. Analysis indicates no direct association with known brand impersonation or cryptocurrency drainer kits, suggesting a generic phishing campaign targeting a broad range of services. The infrastructure appears to be hosted behind a content delivery network, which is commonly exploited to obscure the true origin of malicious activity. Infrastructure analysis reveals the domain was registered on April 20, 2026, through Openprovider and currently resolves to the IP address 188.114.96.3, geolocated to a network operated by a major CDN provider. Security vendor detections on VirusTotal stand at 17 out of 95, with the domain appearing on at least one security blocklist. The SSL certificate is issued by Google Trust Services under the identifier WE1, which does not inherently indicate maliciousness but is frequently observed in phishing operations due to its ease of acquisition. As of the latest assessment, webrat.top remains active and continues to resolve to the aforementioned IP address. The domain has been blocked by at least one security filter, though residual risk persists due to the potential for rapid infrastructure changes. Users and network administrators are advised to implement DNS-based blocking for the domain and its associated IP, monitor for credential reuse attempts, and verify the legitimacy of any login prompts originating from this domain or similar infrastructure.