pgwin138[.]net

pgwin138.net is identified as a generic phishing infrastructure that remains active as of July 12 2026. The domain was registered on 21 November 2025 through NameCheap, Inc., and it is currently listed on a single security blocklist. Early detection by PhishDestroy placed the domain under observation, indicating its use in credential‑stealing campaigns.

The domain resolves to the IPv4 address 185.148.104.116, which is geolocated to Russia and associated with the individual Dolgova Alena Andreevna. Reputation scoring from Gridinsoft assigns a zero‑point trust rating (0/100), reflecting extreme suspicion. The hosted service presents a Google Trust Services / WE1 SSL certificate, yet HTTP requests return a 403 status code, suggesting that malicious pages may be served only after specific conditions are met.

VirusTotal analysis shows that four out of ninety‑five scanned security vendors flagged the domain, providing independent confirmation of malicious intent. AlienVault OTX records a single pulse linking pgwin138.net to known phishing activity, reinforcing the threat profile. The modest detection footprint—one blocklist entry and limited vendor flags—does not diminish the risk, as the infrastructure appears deliberately low‑profile.

Defenders should add 185.148.104.116 to network deny lists and enforce DNS filtering for pgwin138.net. Email security gateways must treat any messages referencing this domain as suspect and apply strict quarantine or sandbox analysis. Continuous monitoring of the associated IP and TLS certificate for changes is advised, as threat actors may pivot to new payloads while retaining the same infrastructure. Incident response teams should prioritize collection of any logs containing connections to this domain for attribution and potential identification of credential theft attempts.