petitesannonces-x[.]com

This domain, petitesannonces-x.com, is actively flagged as a high-risk phishing site targeting classified advertisement users. Registered on April 30, 2026, through ONLINE SAS, the domain resolves to a Netherlands-based IP (81.171.3.205) hosted by LeaseWeb Netherlands B.V. The page title 'Accueil' suggests an attempt to mimic a French-language classifieds platform, though no specific brand impersonation has been confirmed in available data. Infrastructure analysis reveals the use of Let's Encrypt SSL (R12) and nameservers ns1eu.service-dns.net, ns2eu.service-dns.net, and ns3eu.service-dns.net. The domain currently returns an HTTP 503 status, which may indicate temporary takedown efforts or backend maintenance by the threat actor. MX records point to the domain itself (priority 0), a common tactic to facilitate credential-harvesting emails. Security vendors have detected this domain on three blocklists, including PhishDestroy, MetaMask, and SEAL. While 11 of 91 vendors on VirusTotal flag the domain as malicious, the exact phishing kit or payload remains unconfirmed. Defenders should treat this domain as active and capable of distributing credential theft or malware. Recommended actions include immediate blocking at the DNS and network level, monitoring for related domains using the same nameserver or IP range, and alerting users who may have interacted with the site. Given the domain's age and persistent blocklist presence, it is likely part of a broader campaign rather than an isolated incident.