breaker[.]sbs

This domain, breaker.sbs, is identified as a credential harvesting phishing site targeting users through fraudulent login interfaces. Analysis indicates the domain is currently offline, though prior activity suggests it was designed to capture sensitive authentication details, including usernames and passwords. No specific brand impersonation has been confirmed at this stage, but the infrastructure aligns with typical phishing operations. Infrastructure analysis reveals the domain was registered on April 28, 2026, through FewMoreTaps OÜ, a registrar frequently associated with high-risk domains. It resolves to the IP address 151.236.109.225 and holds a Gridinsoft trust score of 0/100, reflecting its malicious classification. VirusTotal reports 0 detections out of 95 security vendors, indicating limited visibility at the time of assessment. The domain appears on a single security blocklist and was previously flagged in one AlienVault OTX threat intelligence pulse. Its SSL certificate is issued by Let's Encrypt, a common choice for phishing sites due to its accessibility and low cost. Current status confirms the domain has been taken offline, likely following detection and mitigation efforts. Despite its inactive state, the domain's infrastructure remains a potential risk for future malicious activity. Organizations are advised to block the domain and its associated IP (151.236.109.225) at the perimeter level. Security teams should monitor for related domains registered through FewMoreTaps OÜ or resolving to the same IP range. End-users who may have interacted with the site should reset credentials immediately and enable multi-factor authentication where available. Continuous threat intelligence monitoring is recommended to track any resurgence or evolution of this campaign.