sortaba[.]sbs

The domain sortaba.sbs has been identified as infrastructure supporting credential theft operations. Analysis indicates the site is designed to harvest user login credentials, likely through fraudulent login portals or deceptive forms. As of the latest verification, the domain is offline, though prior activity suggests it was actively used in malicious campaigns targeting unsuspecting users. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameSilo, LLC, a registrar commonly associated with low-cost and short-lived malicious domains. The domain resolves to the IP address 104.21.62.31, a Cloudflare-associated address often leveraged to obscure hosting origins. Security vendors on VirusTotal flagged the domain, with 2 of 95 engines detecting it as malicious. Additionally, the domain appears on one security blocklist, further corroborating its association with phishing activity. The page title, 'Laravel,' suggests the use of a PHP web framework, which may have been exploited to deploy credential-harvesting scripts or fake authentication interfaces. Current status confirms sortaba.sbs is offline, though the risk of re-emergence remains elevated due to the domain's recent registration and association with credential theft infrastructure. Organizations and individuals are advised to block the domain at the network level and monitor for any resolution changes or renewed activity. Users who may have interacted with the domain should immediately reset credentials for any accounts accessed during the exposure window. Security teams should review logs for connections to 104.21.62.31 or related domains registered through NameSilo around the same period, as these may indicate broader campaign targeting.