rnailerrlite[.]com

This domain, rnailerrlite.com, is identified as a credential theft operation targeting users of Plesk Obsidian 18.0.74. The site mimics legitimate Plesk control panel interfaces to deceive victims into submitting login credentials, which are then harvested for unauthorized access to hosting environments, email accounts, or administrative panels. Credential theft of this nature often leads to further compromise, including unauthorized data exfiltration, deployment of malware, or lateral movement within affected networks. The use of a well-known control panel brand increases the likelihood of successful exploitation, particularly among system administrators and IT personnel. Analysis indicates rnailerrlite.com was registered on November 13, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domain registrations. The domain resolves to the IP address 178.16.54.185 and is flagged by 8 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on one security blocklist and is currently offline, though this status may change. The page title, Plesk Obsidian 18.0.74, directly matches the legitimate software version, reinforcing the impersonation attempt. Users who visited rnailerrlite.com or entered credentials on the site should immediately revoke and reset all exposed passwords, particularly those associated with hosting, email, or administrative accounts. Enable multi-factor authentication (MFA) on all critical systems to mitigate the risk of unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or configuration changes, and review connected devices for signs of compromise. If the domain was accessed in a corporate environment, initiate an internal investigation to determine the scope of exposure and isolate affected systems. Network administrators should block the domain and its associated IP (178.16.54.185) at the perimeter to prevent further interaction.