lanfero[.]sbs

This domain, lanfero.sbs, is flagged for hosting a generic phishing page specifically designed to impersonate a Plesk Obsidian 18.0.74 login interface. The threat type involves credential harvesting, where attackers mimic legitimate server management portals to deceive system administrators or hosting clients into submitting sensitive login credentials. The risk level is elevated due to the targeted nature of the impersonation and the potential impact of compromised server access, which could lead to further infrastructure exploitation or data breaches. Analysis indicates multiple technical indicators supporting the malicious classification. The domain resolves to IP address 46.151.182.165, hosted under AS205759 (Ghosty Networks LLC) in Luxembourg. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, while it appears on at least one security blocklist. The SSL certificate is issued by Plesk, which aligns with the page title but does not validate legitimacy. The domain was registered on February 21, 2026, an anomalous creation date suggesting potential typosquatting or preemptive malicious registration. Additional infrastructure analysis reveals the domain is currently offline, though this status may change rapidly. Mitigation steps should focus on preventing credential exposure and verifying infrastructure authenticity. System administrators and hosting clients are advised to inspect all login portals for discrepancies, particularly in domain names and SSL certificate issuers. Multi-factor authentication should be enforced for all server management interfaces to mitigate the impact of stolen credentials. Network-level blocking of the IP address 46.151.182.165 and domain lanfero.sbs is recommended for organizations using Plesk or similar management tools. Security teams should monitor for similar impersonation attempts, particularly domains mimicking software version numbers or using unconventional top-level domains. If credentials were submitted to this domain, immediate password resets and account audits are critical to prevent unauthorized access.