berglg[.]com

PhishDestroy identifies berglg.com as a credential theft domain impersonating a private browsing environment to harvest sensitive user data. The domain leverages a deceptive page title 'about:privatebrowsing' to mimic legitimate browser interfaces, tricking users into entering credentials or cryptocurrency wallet details under false pretenses. Security researchers should treat this as a high-priority threat due to its active status and potential for financial exploitation. This domain was flagged with 0 detections out of 95 VirusTotal scans, indicating it currently evades detection by major antivirus engines. It resolves to IP address 188.114.96.3 and was registered through Fewmoretaps OU d/b/a Trustname.com on November 23, 2025. The SSL certificate issued by Google Trust Services adds superficial legitimacy, while the recent domain creation suggests a short-lived campaign targeting unsuspecting users. Users who visited berglg.com should immediately clear browser cache and cookies, review stored credentials for unauthorized access, and consider revoking any cryptocurrency wallet permissions granted to this domain. Report the domain to your antivirus provider and block 188.114.96.3 at the network level. Avoid re-entering sensitive information on this site and monitor financial accounts for suspicious transactions.