ebay-kleinanzeigen[.]order981273127301[.]shop

PhishDestroy identifies ebay-kleinanzeigen.order981273127301.shop as an active credential harvesting scam targeting eBay Kleinanzeigen users. The domain employs a deceptive subdomain leveraging the trusted brand name to mislead victims into entering sensitive login credentials on a fraudulent login portal. Analysis reveals no current detections on VirusTotal despite clear malicious intent, highlighting the evolving sophistication of such attacks. The SSL certificate, issued by Let’s Encrypt, adds superficial legitimacy, but the domain’s infrastructure raises immediate red flags. This adversary tactic mirrors recent trends where threat actors rapidly deploy subdomains on newly registered domains to bypass security controls and harvest credentials for further exploitation.

This domain was flagged with zero detections across 95 VirusTotal engines as of the latest scan, confirming its stealthy nature. It resolves to IP address 188.114.97.3, a known bulletproof hosting provider frequently associated with malicious campaigns. The seed data (0dca2c) associates this domain with a newer registration cohort, suggesting an opportunistic campaign rather than a long-standing infrastructure. Only two security vendors currently list this domain on their blocklists, indicating a lag in threat intelligence dissemination. Trust scores from multiple sources remain neutral or unrated due to the domain’s recent appearance, but the absence of detections should not be interpreted as safety. The combination of low detection coverage, reliance on a reputable SSL issuer, and association with a suspicious hosting environment creates a high-risk threat landscape for unsuspecting users.

Mitigation requires immediate network-level blocking of the domain and IP address at firewalls and DNS layers to prevent user exposure. Users should be warned through security awareness training to scrutinize URLs carefully, especially those mimicking legitimate subdomains (e.g., *.order981273127301.shop). Enterprises must deploy real-time URL filtering and browser isolation tools to intercept access attempts. Password policies should enforce multi-factor authentication (MFA) and prohibit reuse across services, limiting the potential impact of credential theft. Threat hunting teams should search proxy logs and SIEM for connections to 188.114.97.3 and monitor for anomalous login attempts originating from this IP. Regular re-scanning of the domain through sandboxed analysis is recommended as threat actors frequently rotate infrastructure. This advisory remains active until further intelligence indicates takedown or remediation.