andreasbergqvist[.]com

This domain, andreasbergqvist.com, is flagged for high-risk brand impersonation targeting Banco Itau, a financial institution. Analysis indicates the site presented a page titled 'Itau Card,' mimicking the bank’s legitimate card services portal. No drainer kit signatures were identified, but the infrastructure aligns with credential harvesting operations typical of phishing campaigns impersonating financial entities. Infrastructure analysis reveals the domain was registered through One.com A/S on August 31, 2008, and currently resolves to IP address 37.27.37.67, hosted on AS24940 (Hetzner Online GmbH) in Finland. Security vendor detections on VirusTotal report 23/95 flags, while Google Safe Browsing explicitly classifies the domain as phishing. The domain appears on one security blocklist, and no SSL certificate was observed during active monitoring. These indicators collectively confirm malicious intent. The domain has since been taken offline, likely following detection and reporting. However, residual risk persists due to the domain’s historical registration and potential for reactivation under the same or altered infrastructure. Organizations are advised to monitor for recurring activity, particularly under similar hosting providers or registrars. Network defenders should ensure endpoint protections block access to this domain and any associated IPs, while financial institutions should alert customers to verify URLs before entering credentials.