item[.]ehay[.]com[.]login[.]secures-wr8wsvzt[.]construccionesjlfabririssas[.]com

The domain item.ehay.com.login.secures-wr8wsvzt.construccionesjlfabririssas.com was registered on 22 September 2022 through PublicDomainRegistry.com, operated by PDR Ltd. It resolves to the IPv4 address 107.6.164.22 and is served by the authoritative nameservers ns1.tuhostingwb.com and ns2.tuhostingwb.com. Since its creation the domain has been listed on two public phishing blocklists—PhishDestroy and OpenPhish—and remains active. VirusTotal reports 20 positive detections out of 91 scanned scanners, indicating that multiple security vendors have flagged the domain as malicious.

The infrastructure appears to be a low‑cost hosting setup commonly used for credential‑stealing operations. No public SSL certificate details, HTTP response codes, or page title have been disclosed, so the exact content of the landing page is not yet verified. The absence of a disclosed target brand or phishing kit leads to a generic credential phishing classification.

Defenders should block the full domain and its parent zone in URL filtering and DNS denylists, enforce outbound traffic controls to the hosting IP, and monitor authentication attempts that could be redirected through this host. Continuous monitoring of the IP reputation, periodic rescans on VirusTotal, and ingestion of the PhishDestroy and OpenPhish identifiers into threat‑intel feeds are recommended to mitigate potential abuse.