pirunta[.]sbs

This domain, pirunta.sbs, is flagged as a generic phishing site designed to harvest user credentials through deceptive login interfaces. Analysis indicates no direct association with known brand impersonation campaigns or drainer kits, suggesting a standalone credential theft operation. The page title 'Even geduld...' (Dutch for 'Please wait...') implies a loading or redirect mechanism, likely intended to mask malicious activity while collecting sensitive information from victims. Infrastructure analysis reveals multiple technical indicators of compromise. The domain holds a VirusTotal detection score of 7/95, with security vendors identifying it as malicious. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 26, 2026, it resolves to the IP address 188.114.97.3, a Cloudflare proxy endpoint. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Additional technical artifacts include HTTP/3 protocol usage and a Let's Encrypt SSL certificate, both commonly employed to evade detection and enhance perceived legitimacy. Currently, pirunta.sbs is offline, reducing immediate risk to end users. However, the domain remains registered and could be reactivated at any time. The registrar's lack of proactive takedown measures and the use of bulletproof hosting infrastructure suggest persistent threat potential. Users are advised to treat any prior interaction with this domain as compromised, reset credentials for associated accounts, and monitor for unauthorized access. Organizations should update blocklists to include this domain and its resolved IP, while security teams should investigate logs for connections to 188.114.97.3 during the active period.