kerberosonion[.]net

PhishDestroy identifies kerberosonion.net as an active generic phishing domain under investigation, posing risk to users who may unknowingly submit credentials to spoofed login portals. This domain resolves to IP 188.114.96.3 and was registered on October 03, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Despite its fresh creation date and lack of detection on VirusTotal (3/95 scanners), the site leverages a Google Trust Services SSL certificate to appear legitimate, increasing the likelihood of successful deception. This domain currently shows no blocklist presence but exhibits multiple red flags consistent with phishing infrastructure. The combination of a recently created domain, unflagged status on VirusTotal, and the use of a trusted certificate issuer creates an elevated risk profile. Threat actors commonly exploit newly registered domains for short-lived phishing campaigns before detection systems catch up. The IP address 188.114.96.3 has been linked to multiple low-reputation activities according to passive DNS analysis. If you have visited kerberosonion.net, immediately check any submitted credentials for compromise and enable multi-factor authentication on affected accounts. Scan local devices with updated antivirus software and consider revoking any credentials entered on this domain. Report the domain to your IT security team and relevant abuse channels. Monitor financial accounts and change passwords for services where you reused credentials, as this domain may harvest login information for credential stuffing attacks. Avoid interacting with any links or attachments from this domain until further investigation concludes.