pregnabalance[.]com[.]redbagproductions[.]com

The domain pregnabalance.com.redbagproductions.com is currently registered through Ultahost, Inc. and resolves to four authoritative name servers operated by the same provider (ns1.ultahost.com through ns4.ultahost.com). WHOIS data indicates the registration remains active as of the report date, July 27 2026. An HTTP request to the root URL returns a 200 OK status, confirming that a web service is reachable. VirusTotal has recorded detections from 12 out of 91 scanned security vendors, indicating that a minority of scanners have identified malicious characteristics associated with the host.

The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy filtering service, which aligns with its classification as a high‑risk generic phishing infrastructure. Analysis of the available telemetry does not reveal additional attributes such as SSL certificate details, hosting IP address, or geographic attribution, and no page title or brand targeting information has been disclosed. Consequently, the precise phishing campaign vector, targeted victims, or any associated credential‑harvesting pages remain unknown. The presence of multiple detections on VirusTotal combined with active blocklist listings suggests that the domain is being used for malicious purposes, likely to host phishing pages or related payloads, consistent with the generic phishing threat type assigned.

Defenders should treat any traffic to pregnabalance.com.redbagproductions.com as hostile. Recommended mitigation steps include adding the domain to network and endpoint blocklists, ensuring that email gateways deny URLs pointing to the host, and monitoring DNS logs for lookups of the associated name servers. Continuous re‑evaluation is advised, as additional intelligence such as hosting infrastructure, SSL fingerprints, or observed payloads may emerge and further refine the risk profile.