130[.]prasolovpartners[.]com

Domain 130.prasolovpartners.com has been flagged for generic phishing activity as of recent analysis. The domain, registered through GoDaddy.com, LLC, utilizes a ZeroSSL certificate and resolves to IP 45.94.158.209. No specific brand impersonation or drainer kit has been identified at this stage, but the threat type remains under investigation for broader phishing campaigns. Users should treat any interactions with caution and avoid sharing credentials or sensitive data if prompted by this domain.

Technical indicators reveal this domain is currently undetected on VirusTotal with a 2/95 score, suggesting it may be newly operational or employing evasion techniques. Registered on October 29, 2023, the domain has not yet been flagged by Google Safe Browsing (GSB) or widely added to blocklists, indicating a low detection rate but not necessarily low risk. The lack of immediate detections underscores the need for proactive monitoring and user vigilance.

Current status remains active, with SOC teams actively monitoring for associated indicators. Immediate actions include blocking the domain and IP at the network level while advising users to report any encounters. Despite low initial detections, the risk remains significant due to the domain’s active status and potential for rapid escalation in phishing campaigns. Remaining risk hinges on further investigation and broader threat intelligence updates.