ebay-kleinanzeigen[.]order912371283220[.]shop

PhishDestroy identifies a phishing domain, ebay-kleinanzeigen.order912371283220.shop, currently masquerading as a legitimate eBay Kleinanzeigen portal to harvest user credentials. The infrastructure leverages a generic drainer kit designed to mimic transactional pages, with the domain structured to exploit brand recognition. Initial triage reveals a live campaign actively soliciting login attempts, suggesting an ongoing credential harvesting operation. This domain resolves to IP address 188.114.97.3 and operates under a Let's Encrypt SSL certificate to enhance deceptive legitimacy. VirusTotal analysis shows 0 detections out of 95 engines, indicating evasion against current detection signatures. The domain was registered recently, and while specific registrar details remain under review, it has not yet been flagged by Google Safe Browsing. It remains unlisted on major threat intelligence blocklists, increasing exposure to potential victims. Current status is active with a risk level under investigation. Immediate response actions include domain takedown requests to hosting providers and ISPs, along with browser warning submissions. Despite low detection coverage, the absence of blocklist entries and the use of a trusted SSL certificate elevate the risk of successful compromise. Users are strongly advised to avoid interacting with this domain and verify all transactional links through official eBay Kleinanzeigen channels.