top-28circles[.]com

This domain, top-28circles.com, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. Analysis indicates no direct brand impersonation, suggesting a generic phishing campaign likely targeting multiple platforms or services. The infrastructure shows no immediate signs of a known drainer kit, though further forensic examination of the page source or redirect chains may reveal additional payload delivery mechanisms. Technical indicators confirm the domain's malicious nature. The domain is flagged by 11 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly classifying it as phishing. Infrastructure analysis reveals registration through Name SRS AB, a registrar frequently associated with malicious domains. The domain resolves to the IP address 185.178.45.211, which has been linked to prior phishing campaigns. Creation date records indicate the domain was registered on 2024-05-10, aligning with recent phishing activity trends. The domain appears on one security blocklist, and the current page title, '403 Forbidden,' suggests either a misconfiguration or an attempt to evade automated detection tools. As of the latest assessment, top-28circles.com remains active, posing a high risk to users who may encounter it through phishing emails, malicious advertisements, or compromised websites. Immediate response actions include blocking the domain at the network level and reporting it to relevant threat intelligence platforms. Despite these measures, the domain's continued operation underscores the persistent threat posed by credential harvesting campaigns. Users are advised to verify URLs before entering credentials, employ multi-factor authentication, and rely on browser-based or endpoint security tools to detect and block phishing attempts in real time.