pb489[.]encryptfile[.]cc

Analysis of pb489.encryptfile.cc indicates a newly registered infrastructure used for generic phishing. The domain was created on April 25, 2026 and is hosted behind Cloudflare (IP 172.67.223.136, CA). It uses Let’s Encrypt certificate (E8) and returns an HTTP 301 redirect. Nameserver delegation points to ns71.cloudns.net, ns72.cloudns.com, ns73.cloudns.net, and ns74.cloudns.uk, all associated with the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED. The site appears on one security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, and VirusTotal reports four of ninety‑four scanners flagging the domain, reinforcing the high‑risk classification. While the page title "GamePulse — Next-Level Gaming News" suggests an attempt to masquerade as gaming content, the actual payload or credential‑capture mechanisms have not been publicly disclosed, leaving the exact phishing workflow uncertain. Defenders should add pb489.encryptfile.cc to block lists, monitor DNS queries for the associated Cloudflare IP, and enforce strict outbound filtering to prevent users from accessing the domain. Continuous re‑evaluation is advised as threat intel updates may reveal additional indicators of compromise.