Phishing detection: allegro.plkupteraz83219321698.sbs

Allegro
http://allegro.plkupteraz83219321698.sbs Access site
Screenshot
Screenshot of allegro.plkupteraz83219321698.sbs
Investigate
Domain allegro.plkupteraz83219321698.sbs0 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 104.21.54.102
urlscan page.ip VirusTotal ipinfo Greynoise
URL http://allegro.plkupteraz83219321698.sbs
urlscan Wayback archive.today
Cert WE1
crt.sh Censys Google CT
Phishunt analysis Beta
38 medium suspicion suspiciousheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +5.1 Site cluster
  • +4.5 Brand in title
  • +4.1 Brand in screenshot
  • +4.0 Young domain
  • +3.0 PhishTank
  • +2.6 Brand in subdomain
  • +2.2 Country mismatch
  • +1.8 ASN reputation
  • +1.3 Suspicious TLD
  • +0.9 Young certificate
  • +0.9 No registrar lock
  • +0.6 Long domain
  • +0.6 Final host mismatch
  • +0.6 Registrar reputation
  • +0.3 Free CA
  • +0.1 External scripts
  • +0.1 Deep subdomain
22 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Site places the Allegro brand in a subdomain over a long, obfuscated .sbs TLD domain to impersonate the Polish classified marketplace and harvest payment or login credentials. Confirmed malicious by PhishTank with a full keyword classifier match.

PhishTankBrand in subdomainFinal host mismatch
AI-generated from stored detector signals - the AI never visited the site. · 2026-08-28 · confidence 86%
Domain & Network
Whois
Registrar Global Domain Group LLC
Network
IP 104.21.54.102
Country United StatesUnited States
Hosting Cloudflare, Inc.
ASN AS13335
TLS Cert WE1
External detection PhishTank
CleanGoogle Safe Browsing · OpenPhish · TweetFeed · urlscan.io · SANS ISC
Campaign
This detection belongs to suspected cluster 769c561db2f8 (14 members total)
Related infrastructure Betasuspected links from shared infrastructure, not attribution
allegro.lokalna-9938201.sbs 50 similar text same redirect target registered together same registrar appeared together (24h) certs issued together same favicon same screenshot
active 2026-08-28
allegrolokalnie.lokalna-9938201.sbs 50 similar text same redirect target registered together same registrar appeared together (24h) certs issued together same favicon same screenshot
active 2026-08-28
allegrolokalnie.lokalna-ofeta16x3v0yj934b75v0.shop 36 similar text same redirect target appeared together (72h) same favicon same screenshot
no longer tracked
allegrolokalnie.oferta-lokalna8654968923445.shop 34 similar text same redirect target appeared together (7d) same favicon same screenshot
active 2026-08-22
allegro.lokalna-059272.sbs 31 same redirect target registered together same registrar appeared together (24h) certs issued together same favicon
active 2026-08-28
Top 5 of 13 related · rebuilt daily · corr-1.2.0 · related infrastructure API
Report this phishing
Network / ASN Cloudflare, Inc.
Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-08-28 11:01 UTC  ·  Last refreshed 2026-08-30 15:30 UTC