ebay-kleinanzeigen[.]order91231293012084[.]shop

This domain, ebay-kleinanzeigen.order91231293012084.shop, is flagged as a brand impersonation phishing site targeting users of a classifieds platform. Analysis indicates the domain mimics legitimate listings to harvest credentials or financial details, though no specific drainer kit signatures have been identified. The infrastructure aligns with typical phishing campaigns leveraging recognizable brand names to deceive victims into submitting sensitive information. Infrastructure analysis reveals the domain was registered on April 02, 2026, through Dynadot Inc., a registrar frequently associated with malicious registrations. It resolves to the IP address 104.21.43.104, a host shared with other suspicious domains. Security vendors on VirusTotal flagged this domain with a detection score of 15/95, indicating moderate confidence in its malicious nature. The domain appears on one security blocklist and was previously blocked by automated phishing detection systems. Notably, the domain’s SSL certificate is issued by Let’s Encrypt, a common tactic to lend false legitimacy to phishing sites. The domain is currently offline, likely taken down due to detection by security systems or manual intervention. However, residual risk remains as threat actors may re-deploy the infrastructure under a new domain or IP. Users who interacted with this domain should immediately revoke any shared credentials, monitor financial accounts for unauthorized activity, and verify the legitimacy of any communications claiming to originate from the impersonated brand. Organizations are advised to block the domain and its associated IP at the network level to prevent future access attempts.