linor79[.]today

This domain, linor79.today, is identified as a generic phishing infrastructure designed for credential harvesting. Analysis indicates no direct association with a specific brand or drainer kit, though its SSL certificate attributes (issued to PhishDestroy / botadmin.destroy.tools) suggest affiliation with a broader phishing-as-a-service operation. The domain exhibits characteristics typical of credential theft campaigns, likely targeting users through spoofed login portals or fraudulent authentication prompts. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., and resolves to the IP address 47.77.229.72, hosted on Alibaba (US) Technology Co., Ltd. (AS45102). VirusTotal detection metrics show 18 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The SSL certificate, issued under suspicious organizational attributes, further corroborates its phishing classification. No Google Safe Browsing (GSB) listing was observed at the time of analysis. The domain is currently offline, having been taken down following detection and blocking by security systems. While the immediate threat has been mitigated, residual risk persists due to the domain's recent registration and the transient nature of phishing infrastructure. Users who may have interacted with the domain are advised to reset credentials for any accounts accessed during the exposure window. Organizations should monitor for related indicators, including the IP address 47.77.229.72 and the SSL certificate issuer attributes, to preemptively block similar threats. Continuous vigilance is recommended, as threat actors frequently repurpose infrastructure for subsequent campaigns.