satoshilabs[.]visualbook[.]pro

Analysis indicates that satoshilabs.visualbook.pro is an active phishing domain registered through Gransy, s.r.o. and hosted on infrastructure operated by THINline s.r.o. in the Czech Republic. The domain resolves to IP address 91.239.201.10 and uses nameservers ns1.thinline.cz, ns2.thinline.cz, and ns3.cesky-hosting.eu. As of July 20, 2026, the site returns an HTTP 200 status and presents a page titled 'Satoshilabs Group - Group Brand Manuals,' suggesting an attempt to impersonate SatoshiLabs, a known cryptocurrency hardware manufacturer. The SSL certificate is issued by Let's Encrypt (YR2). One security vendor on VirusTotal flags the domain, and it appears on one security blocklist, with PhishDestroy currently blocking access. Infrastructure analysis reveals no evidence of a legitimate association with SatoshiLabs. The domain's registration and hosting details do not align with known official SatoshiLabs digital properties. Defenders should treat this domain as malicious and prioritize blocking at DNS, proxy, and endpoint layers. No further content analysis has been conducted; the exact phishing mechanism remains unconfirmed. Organizations using SatoshiLabs products or services should alert employees to this impersonation attempt and monitor for credential submissions or document downloads originating from this domain.