p2[.]planu[.]click

This domain, p2.planu.click, operates as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the infrastructure is engineered to mimic legitimate services, tricking victims into submitting sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. The domain's page title, 'Site is created successfully!', suggests a hastily deployed or template-based phishing kit, which is commonly used in large-scale campaigns to maximize reach before detection. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on September 23, 2025, through Sav.com, LLC, and currently resolves to the IP address 178.16.53.103, hosted on AS202412 (Omegatech LTD) in the Netherlands. Security vendors on VirusTotal flagged this domain as malicious, with 17 out of 95 engines detecting it as phishing. Additionally, the domain appears on one security blocklist and is actively blocked by Google Safe Browsing for phishing activity. Notably, the absence of an SSL certificate further undermines any semblance of legitimacy, as modern phishing sites typically employ encryption to evade detection. Users who visited p2.planu.click should take immediate remedial action. If any credentials were entered, they must be changed across all platforms where they were reused, prioritizing financial, email, and work-related accounts. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unrecognized logins or transactions. Organizations should block the domain and its associated IP (178.16.53.103) at the network level to prevent further exposure. Given the domain's current offline status, users should remain vigilant for similar phishing attempts, as threat actors often redeploy infrastructure under new domains.