r[.]batiactu[.]info

The domain r.batiactu.info was registered through Gandi SAS and first observed on March 11, 2026. It resolves to the IP address 35.205.52.34, which is announced by AS396982 belonging to Google LLC and geolocated in Belgium. The domain is served over HTTPS using a Let’s Encrypt certificate (E7) and returns HTTP status 200 with the page title "Technical subdomain". Nameservers mitch.ns.cloudflare.com and meelani.ns.cloudflare.com indicate Cloudflare DNS hosting.

Multiple reputation services flag the domain as high‑risk. Google Safe Browsing classifies it under the "SOCIAL_ENGINEERING" category, and Gridinsoft assigns a trust score of 0 out of 100. Scamadviser reports a trust score of 1 out of 100, and the domain appears on a single security blocklist maintained by PhishDestroy. VirusTotal analysis shows that 9 of 95 scanned security vendors have flagged the domain, reinforcing the suspicion of malicious activity. The overall risk level is marked as high and the current status remains active.

While the available data confirms a phishing intent, the specific payload or targeted brand has not been disclosed in the public intelligence. The presence of a generic page title and the lack of visible malicious content suggest that the domain may be used as a landing page to harvest credentials or redirect victims to secondary malicious sites. No additional infrastructure, such as command‑and‑control servers or malware binaries, has been identified at this time.

Defenders should immediately block outbound and inbound traffic to r.batiactu.info at the network perimeter and enforce DNS sinkholing for the associated IP address. Continuous monitoring of DNS queries and TLS certificate changes is advised, as the infrastructure could be repurposed or expanded. Security teams should also update endpoint protection rules to include the observed VirusTotal signatures and consider sharing the indicator set with peer organizations to broaden detection coverage.