wi6ndloch0bei[.]sbs

The domain wi6ndloch0bei.sbs was identified as a generic phishing site designed to impersonate Plesk Obsidian 18.0.74, a widely used web hosting control panel. This domain specifically targeted system administrators and hosting providers by presenting a fraudulent login interface to harvest credentials. As of the latest verification, the domain has been taken offline, though prior activity suggests it was actively used for credential theft and potential follow-on attacks such as server compromise or malware deployment. Analysis indicates this domain was registered through Dynadot LLC on February 21, 2026, an anomalous creation date likely intended to evade temporal detection heuristics. It resolved to the IP address 185.161.251.62, hosted under AS215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP) in Germany. The domain appeared on one security blocklist and was flagged by 20 of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious nature. The SSL certificate was issued under the R12 root, a common but not exclusive indicator of low-cost or automated certificate provisioning often associated with phishing infrastructure. Current status confirms the domain is offline, though residual risk remains for any credentials previously submitted. Organizations are advised to monitor for unauthorized access to hosting environments, particularly those using Plesk Obsidian. Network administrators should block the IP 185.161.251.62 and the domain wi6ndloch0bei.sbs at perimeter defenses. Users who may have interacted with this domain should reset credentials immediately, enable multi-factor authentication, and review server logs for anomalous activity. Future monitoring of domains registered through the same registrar or resolving to the same IP range is recommended to detect potential campaign resurgence.