planerabit[.]com

This domain is flagged for hosting a credential harvesting phishing campaign targeting unsuspecting users. Analysis indicates the site is designed to mimic legitimate login portals, tricking visitors into submitting sensitive authentication details. The elevated risk classification stems from its active exploitation in recent phishing operations and confirmed malicious infrastructure. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain planerabit.com was registered on March 08, 2026, through Wild West Domains, LLC, an uncommon registrar for legitimate services. It resolves to the IP address 66.45.23.50, which has been associated with prior phishing activity. Security vendors on VirusTotal detect the domain at 8/95, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt, a common choice among threat actors to lend superficial legitimacy. Detected technologies include YouTube, Bootstrap, Smartsupp, Slick, OWL Carousel, jQuery Migrate, jQuery, and Google Hosted Libraries, which are frequently leveraged to enhance the appearance of authenticity. Mitigation measures should focus on containment and user awareness. Organizations are advised to block the domain and its resolving IP address (66.45.23.50) at the network perimeter. Endpoint protection systems should be updated to include this domain in phishing detection rules. Users who may have interacted with the site should be instructed to reset credentials immediately, particularly if the same passwords are used across multiple platforms. Security teams should monitor for unusual authentication attempts or unauthorized access originating from affected accounts. Given the domain's offline status, ongoing vigilance is required to detect potential re-emergence under a different name or infrastructure.