peaksballs[.]com

PhishDestroy identifies peaksballs.com as an active credential harvesting domain posing as a legitimate service to steal user credentials. This domain mimics common login portals to capture entered usernames and passwords, potentially granting attackers access to sensitive accounts. The threat actor behind this campaign likely uses social engineering tactics such as deceptive emails or fake advertisements to lure victims to the malicious site. Once credentials are harvested, they may be sold on dark web forums or used for further fraudulent activities, including financial theft or corporate espionage. This domain was flagged by PhishDestroy on February 22, 2026.

This domain poses significant risk due to its low detection rate and recent creation. VirusTotal currently shows 0 detections out of 95 scanners, indicating evasion of most antivirus and threat intelligence platforms. peaksballs.com resolves to IP address 104.21.80.143 and uses a Let's Encrypt SSL certificate, which may lend false credibility to unsuspecting users. The domain was registered through DEVEXPANSE LTD d/b/a Regery.com, a known bulletproof hosting provider often abused by malicious actors for short-lived phishing operations. Given its recent registration (February 22, 2026), this domain has had no time to accumulate blocklist entries, allowing it to operate undetected by many security systems.

If you visited peaksballs.com or entered any credentials, immediately change passwords for accounts using the same login details. Scan your device with updated antivirus software and monitor accounts for suspicious activity. Report the domain to your IT security team or local cybercrime unit. Avoid clicking links in unsolicited emails and verify website legitimacy through official channels before entering sensitive information. Consider using password managers with domain verification features to prevent credential theft on lookalike sites.