plantquil[.]com

Analysis of plantquil.com indicates a confirmed phishing domain actively targeting user credentials. The domain was registered on May 14, 2021, through Porkbun LLC and currently resolves to IP address 158.94.209.40. Infrastructure analysis reveals hosting via Namecheap nameservers (dns1.namecheaphosting.com and dns2.namecheaphosting.com), a common provider for both legitimate and malicious domains. As of July 22, 2026, the domain remains operational and is flagged by 17 of 95 security vendors on VirusTotal, including detection by PhishDestroy and OpenPhish, which classify it as a phishing threat.

It also appears on two additional security blocklists, reinforcing its malicious classification. No specific brand impersonation or phishing kit details are currently available in the observable evidence, though the domain's classification as 'generic phishing' suggests it is likely designed to harvest login credentials or personal information. The exact content of the site has not been analyzed, and no page title or targeted brand is confirmed.

Defenders should treat this domain as high-risk and prioritize blocking it at the network level. Monitoring for related infrastructure, such as the associated IP (158.94.209.40) and registrar (Porkbun LLC), may help identify additional malicious domains. Given its active status and detection by multiple security vendors, immediate action is recommended to mitigate potential user exposure.