pv-penslonsversicherung[.]net

This domain, pv-penslonsversicherung.net, is flagged as a high-risk credential harvesting phishing site impersonating a pension insurance provider. Analysis indicates the page title 'PV - Kundeninformationen' mimics legitimate customer portals, likely targeting German-speaking users to extract login credentials, personal identification numbers, or financial details. No explicit drainer kit signatures have been observed, but the infrastructure aligns with generic phishing frameworks designed for mass deployment and rapid takedown evasion.

Technical indicators confirm the domain was registered on June 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with bulletproof hosting and phishing operations. It resolves to the IP address 178.16.54.253, which has been linked to prior malicious campaigns in threat intelligence feeds. VirusTotal detection metrics show 4 out of 95 security vendors flagging the domain as malicious, a relatively low ratio suggesting either recent activation or evasion techniques. Google Safe Browsing (GSB) status remains unconfirmed, and no public blocklist entries beyond VirusTotal have been recorded at the time of analysis.

The domain remains active as of the latest verification, with no evidence of suspension or sinkholing. Response actions by hosting providers or registrars have not been observed, indicating potential gaps in abuse mitigation. The remaining risk is classified as high due to the domain's operational status, targeted impersonation of financial services, and the use of a registrar with a history of slow enforcement. Users are advised to block the domain and IP at the network level, monitor for credential reuse attempts, and verify pension-related communications exclusively through official channels.