porndepfile[.]com

This domain, porndepfile.com, is identified as a credential theft operation impersonating legitimate file-sharing platforms such as Flashbit, Fboom, and Fileboom. The site presents itself as a pornographic content repository offering downloads, a common tactic to lure users into entering login credentials or installing malicious payloads. No explicit crypto drainer kit signatures were detected, but the infrastructure aligns with credential harvesting campaigns targeting adult content consumers. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com. It resolves to the IP address 188.114.96.3 and is currently flagged by 3 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is blocked by at least one threat intelligence feed. Technologies detected include PHP, jQuery, OWL Carousel, and Cloudflare services, which are frequently leveraged to obfuscate malicious activity. The SSL certificate is issued by Google Trust Services, adding a layer of apparent legitimacy. As of the latest assessment, porndepfile.com has been taken offline, reducing immediate exposure risk. However, the domain's infrastructure remains registered, and similar campaigns may re-emerge under new domains or IPs. Organizations should monitor for related indicators, including the IP 188.114.96.3 and registrar patterns associated with Fewmoretaps OU. Users are advised to verify the authenticity of file-sharing platforms before entering credentials and to employ multi-factor authentication to mitigate credential theft risks.