pulte[.]top

This domain, pulte.top, is flagged as a generic phishing site specializing in credential theft targeting customers of Pulte Homes, a major residential construction company. Analysis indicates the site mimics legitimate Pulte login portals, likely designed to capture usernames, passwords, and potentially financial details under the guise of account management or warranty services. No specific drainer kit has been identified yet, but the infrastructure aligns with common phishing-as-a-service frameworks observed in recent campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on April 23, 2025, through NameSilo, LLC, and currently resolves to the IP address 207.189.11.170. VirusTotal reports 0 detections out of 95 engines, suggesting the site has not yet been widely flagged or analyzed. Google Safe Browsing status is currently unknown, and no blocklist entries have been recorded at the time of this report. The domain's age and lack of detection history may indicate an early-stage campaign or evasion techniques such as domain shadowing or fast-flux DNS. As of the latest verification, pulte.top remains active and unresponsive to takedown requests. The risk level is classified as under investigation due to the absence of confirmed victim reports or widespread detection. Recommended response actions include monitoring for new detections, submitting the domain to additional threat intelligence platforms, and blocking the IP address 207.189.11.170 at the network perimeter. Organizations should alert employees and customers to avoid interacting with the domain and report any suspicious communications claiming to originate from Pulte Homes. The remaining risk is elevated due to the domain's operational status and potential for undetected credential harvesting.