registration-umbra[.]com

This domain, registration-umbra.com, is flagged as a generic phishing site designed to mimic a legitimate Plesk Obsidian 18.0.73 control panel login interface. Analysis indicates the site likely targeted system administrators or hosting clients with the intent to harvest credentials for unauthorized access to server environments. The fraudulent page could enable attackers to compromise hosting infrastructure, deploy malware, or conduct further phishing campaigns from trusted sources. No evidence of cryptocurrency drainer functionality or brand impersonation (e.g., Microsoft, PayPal) was observed—this appears to be a direct infrastructure-targeted credential theft operation. Technical indicators confirm the malicious nature of this domain. VirusTotal reports 3 out of 95 security vendors flagged registration-umbra.com as malicious, a low but significant detection rate suggesting targeted or evasive phishing tactics. The domain was registered on October 28, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains due to lenient abuse policies. Infrastructure analysis reveals the site resolved to IP address 188.114.97.3, a Cloudflare-protected endpoint that may have been used to obscure hosting origins. The domain appears on two security blocklists (ScamSniffer and PhishDestroy) and has since been taken offline, though residual risk remains for users who interacted with the site prior to its removal. Users who visited registration-umbra.com or entered credentials on the site should assume their login details are compromised. Immediate actions include revoking any submitted credentials, particularly for Plesk, cPanel, or other hosting control panels, and rotating passwords for all associated accounts. System administrators should audit server logs for unauthorized access attempts originating from the domain’s IP (188.114.97.3) or related infrastructure. If the site was accessed via a work device, notify internal security teams to assess potential lateral movement risks. Monitor financial and hosting accounts for unusual activity, as stolen credentials may be exploited in follow-up attacks. No direct malware delivery was confirmed, but users should scan devices for secondary infections if the page was interacted with in an unprotected environment.