larpit[.]org

A new credential harvesting domain, larpit.org, was flagged for hosting a generic phishing kit designed to steal user credentials. The domain currently poses an active threat under investigation, with no confirmed affiliation to legitimate services. PhishDestroy assesses this domain as high-risk due to its malicious infrastructure and lack of historical trustworthiness.

This domain was flagged by PhishDestroy with a risk level marked as under investigation. Technical indicators include resolution to IP 172.67.194.6, a Let's Encrypt SSL certificate, a domain creation date of April 25, 2026, and zero detections out of 95 VirusTotal engines. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar with no known ties to legitimate business operations. No current blocklist presence or trust scores have been assigned to this domain, indicating a recently emerged threat.

Users are strongly advised to avoid all interactions with larpit.org, including visiting the site or submitting any credentials. Organizations should implement network-level blocking for this domain and its associated IP (172.67.194.6) to prevent accidental exposure. Security teams should monitor for any additional domains registered by NICENIC INTERNATIONAL GROUP CO., LIMITED or associated infrastructure. Given the absence of detections, this domain may be leveraged in targeted campaigns—proactive blocking is critical to mitigate risk. Users who may have already engaged with the site should change passwords and enable multi-factor authentication on all related accounts immediately.