*.plesk.page

Phishing C&C Exfiltration Download

Attackers can use a customized subdomain of plesk.page to host their phishing websites.

Attackers can use a customized subdomain of plesk.page as their C&C server.

Attackers can add upload functionalities hosted on *.mybluehost.me and exfiltrate data on there.

Malicious tools can be stored on *.plesk.page and downloaded when required.

https://www.joesandbox.com/analysis/600205/0/html