user-prenium[.]com

This domain, user-prenium.com, is identified as a high-risk credential harvesting platform targeting users of MezoPlesk, a web hosting control panel. Analysis indicates the site mimics legitimate MezoPlesk login interfaces to deceive victims into submitting authentication credentials, which are then exfiltrated to attacker-controlled infrastructure. The threat extends beyond credential theft, as compromised control panel access could enable further malicious activities, including server hijacking, malware deployment, or unauthorized data exfiltration from hosted environments. Infrastructure analysis reveals the domain was registered on February 17, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, a registrar frequently associated with abusive domains. The domain resolves to IP address 158.94.209.86, hosted within AS202412 (Omegatech LTD), an autonomous system with a history of hosting malicious content. Security vendor detection on VirusTotal stands at 23 out of 95 engines, indicating moderate to high confidence in malicious classification. Additionally, the domain appears on three distinct security blocklists, including those maintained by anti-phishing and cryptocurrency security communities. The SSL certificate, issued by Let's Encrypt, provides encryption but does not validate legitimacy, as certificates are freely available to both legitimate and malicious actors. Users who visited user-prenium.com or entered credentials on the site should assume compromise and take immediate remedial actions. Credentials submitted to the site must be invalidated across all platforms where they were reused, prioritizing critical systems such as hosting control panels, email accounts, and financial services. System administrators should audit server logs for unauthorized access originating from the domain or its associated IP (158.94.209.86). If MezoPlesk or similar control panel access was involved, a full security review of hosted environments is recommended, including malware scans, permission audits, and password resets for all associated accounts. Monitoring for suspicious activity, such as unauthorized file modifications or unexpected outbound connections, should be implemented for at least 30 days post-exposure.