wyprzedaze-pl[.]com

This domain, wyprzedaze-pl.com, is identified as a phishing site specifically designed to impersonate the Notino brand, a well-known online cosmetics and personal care retailer. The threat type is classified as generic phishing with a focus on credential harvesting and fraudulent payment interception, targeting users through deceptive login and checkout pages. As of the latest analysis, the domain has been taken offline, though prior activity indicates a deliberate attempt to exploit brand trust for financial gain or data exfiltration.

Infrastructure analysis reveals that wyprzedaze-pl.com was registered on February 21, 2026, through Dynadot LLC, a registrar frequently associated with domains involved in phishing campaigns. The domain resolves to the IP address 185.208.159.137, hosted under AS42624 (Global-Data System IT Corporation) in Switzerland. Detection metrics indicate elevated risk, with 19 of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on one security blocklist, further corroborating its association with phishing activity. The SSL certificate, issued by Let's Encrypt (R13), provides a veneer of legitimacy but does not mitigate the underlying threat posed by the site's content or intent.

Current status confirms that wyprzedaze-pl.com is offline, though the infrastructure remains a potential vector for future malicious activity. Organizations and end-users are advised to block the domain and its associated IP address (185.208.159.137) at the network level to prevent accidental exposure. Users who may have interacted with the site should immediately reset credentials for any accounts accessed through it, particularly those linked to financial services or personal data. Monitoring for similar domains registered through Dynadot LLC or resolving to the same IP range is recommended to preemptively mitigate related threats.