acessoriafeira25[.]sbs

The domain acessoriafeira25.sbs has been identified as a credential harvesting phishing site targeting users through fraudulent login interfaces. Analysis indicates this domain is currently offline but previously operated as an active phishing endpoint. No specific brand impersonation has been confirmed, though the generic login page structure suggests broad targeting of user credentials across multiple platforms. Infrastructure analysis reveals the domain was registered on November 23, 2025, through Dynadot LLC, a registrar frequently utilized in phishing operations. The domain resolves to IP address 172.67.223.201, associated with Cloudflare's network (AS13335), a common obfuscation tactic to conceal hosting origins. Detection metrics show 17 of 95 security vendors on VirusTotal flagged the domain as malicious, with additional listings on two security blocklists. Notably, the site lacks an SSL certificate, increasing the likelihood of interception during credential transmission. The page title, 'Site –', further indicates minimal effort to mimic legitimate services, relying instead on generic presentation. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with the site prior to deactivation. Organizations and individuals are advised to monitor for unauthorized access attempts, particularly if credentials were entered on the site. Network administrators should block the IP address 172.67.223.201 and domain acessoriafeira25.sbs at perimeter defenses. Users are recommended to reset passwords for any accounts accessed during the domain's active period and enable multi-factor authentication where available. Continuous monitoring of associated infrastructure is advised, as threat actors may re-establish operations under similar domains.