donsharky[.]xyz

The domain donsharky.xyz is a generic phishing site posing no specific brand impersonation or crypto-drainer functionality. It was operational as a phishing page but has since been taken offline. Users encountering this domain were at elevated risk of credential theft or other fraudulent activity, though no targeted brand or financial drainer kit was identified.

Technical analysis shows donsharky.xyz was flagged by 2 of 95 VirusTotal security vendors, including CRDF and Forcepoint ThreatSeeker. The domain was registered through GMO Internet, Inc. on August 26, 2024, and resolved to the IP address 64.190.63.136, hosted in Germany under AS47846 SEDO GmbH. It appeared on 2 security blocklists, PhishDestroy and Enkrypt, but was not flagged by Google Safe Browsing. The SSL certificate was issued by GoDaddy.com, Inc. via the Go Daddy Secure Certificate Authority - G2. Observed technologies included Node.js, Envoy, Express, HSTS, and Akamai, with a page title reading 'donsharky.xyz - Informationen zum Thema donsharky.'

Individuals who interacted with donsharky.xyz should immediately change any credentials entered on the site and enable two-factor authentication on affected accounts. Monitor accounts for unauthorized activity and report any fraud to relevant financial institutions or identity protection services. The domain can be reported to anti-phishing organizations such as the Anti-Phishing Working Group (APWG) or local cybersecurity authorities for further investigation.