psdbest[.]cam

This domain, psdbest.cam, is identified as a credential theft phishing site designed to harvest user login credentials. Analysis of the page title, PSDBEST, and detected technologies suggests an attempt to mimic legitimate login portals, though no direct brand impersonation is confirmed. The infrastructure lacks overt ties to known crypto drainer kits, focusing instead on traditional credential acquisition methods. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 8 out of 95 security vendors on VirusTotal, with a single entry on security blocklists. It was registered through FewMoreTaps OÜ on April 21, 2026, and resolves to the IP address 176.123.0.199. Technologies detected include WordPress, MySQL, PHP, LiteSpeed, Underscore.js, prettyPhoto, jQuery Migrate, and jQuery. The domain was not listed in Google Safe Browsing at the time of analysis but was actively blocked by at least one security provider. The domain has since been taken offline, reducing immediate exposure risk. However, the registration details and hosting infrastructure remain active, posing a residual threat for potential redeployment. Users who may have interacted with the site are advised to reset credentials for any accounts accessed during the exposure window. Organizations should monitor for similar domains registered under the same registrar or resolving to the identified IP range, as this infrastructure may be reused for future campaigns.