# PhishDestroy domain threat record: blinda.it Content language: English Canonical HTML report: https://phishdestroy.io/domain/blinda.it/ Machine-readable companion: https://phishdestroy.io/domain/blinda.it/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-03 16:37:44 UTC - Last availability or vendor check: 2026-10-22 10:37:03 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 5/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 89.46.110.68 - Registrar in stored WHOIS data: Aruba s.p.a. - Registrar country in stored WHOIS data: Unknown - Last stored HTTP status: 301 - Registration date in stored WHOIS data: 2001-09-26 22:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a102a0-2652-73e4-a81a-21ec851e3672/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/blinda.it - Certificate Transparency search: https://crt.sh/?q=%25.blinda.it - Web Archive lookup: https://web.archive.org/web/*/https://blinda.it/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview blinda.it is an Italian domain that PhishDestroy classifies as an impersonation phishing page, built to pass itself off as a legitimate service and win the trust of its visitors. PhishDestroy first flagged it on 2026-10-03. As of 2026-10-19 the site was still alive and its content was reachable through a redirect, so anyone following a link to it can still land on a live page. How the scam works Impersonation phishing copies the look, name or tone of a brand people already trust. The goal is to get visitors to type in credentials, personal details or payment information, or to act on instructions that seem to come from that brand. Victims typically lose account access, card details or funds once the operators use what was entered. The page currently carries the title "Maintenance," while PhishDestroy classifies the domain as impersonation phishing. Evidence On 2026-10-14, 5 of 92 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. That count is low, but the flags come from several independent threat-intelligence and web-filtering vendors rather than a single source. The domain appears in 5 AlienVault OTX pulses, which means other researchers have also tagged it in shared threat reporting. Among blocklists, PhishDestroy is currently the only one listing it. Infrastructure The domain was registered on 2001-09-27 through Aruba S.p.A., roughly 25 years before PhishDestroy detected it. That makes it a long-established address rather than a freshly registered throwaway. It is hosted in Italy on Aruba's network. The site uses an organization-validated certificate from Actalis, so the browser padlock and certificate details may look more official than on a typical phishing site and should not be read as proof that the content is safe. What to do If you entered a password on blinda.it, change it right away on the real service and on any other account that shares it, then enable two-factor authentication. If you submitted card or bank details, call your bank to block the card and dispute any charges you do not recognise. Watch for follow-up emails or calls that refer to this site, since phishing operators often reuse stolen details for a second attempt. Security teams should block the domain and its redirect at the proxy and DNS level and search their logs for past visits. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a102a0-2652-73e4-a81a-21ec851e3672/ VirusTotal report: https://www.virustotal.com/gui/domain/blinda.it Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=blinda.it Archived copy: https://web.archive.org/web/20261003163827/https://blinda.it/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:31:55 UTC ## Stored page captures - Primary capture: https://i.ibb.co/nMdrp0qL/202e851a4c5d.png Captured: 2026-10-03 16:37:44 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a102a0-2652-73e4-a81a-21ec851e3672.png Captured: 2026-10-03 16:37:44 UTC Source report: https://urlscan.io/result/01a102a0-2652-73e4-a81a-21ec851e3672/ - URLScan capture 2: https://urlscan.io/screenshots/01a0faef-cc75-724b-9985-4a0bf6570fe1.png Captured: 2026-10-03 16:36:42 UTC Source report: https://urlscan.io/result/01a102a0-2652-73e4-a81a-21ec851e3672/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c4966726-ff42-4b7d-b5bd-964701a60651.png Captured: 2026-10-03 17:09:22 UTC Source report: https://radar.cloudflare.com/scan/c4966726-ff42-4b7d-b5bd-964701a60651 SHA-256: 36d07495bcca5f3e48f8eca8aedf572633b1c8597772c12bfb5fcf7563770e66 - URLScan · 2026-07-25: https://screenshots.phishdestroy.io/us/019f96cf-3cfc-7528-a10b-01d8c36bc2f0.png Captured: 2026-07-25 01:06:40 UTC Source report: https://urlscan.io/result/019f96cf-3cfc-7528-a10b-01d8c36bc2f0/ SHA-256: bae8b16f2df4141a19a32f89a1421d82b3449a4d91ddb254e6421fb573a5537c - URLScan · 2026-09-06: https://screenshots.phishdestroy.io/us/01a07897-4ddb-7697-a478-12bb31712d33.png Captured: 2026-09-06 21:19:48 UTC Source report: https://urlscan.io/result/01a07897-4ddb-7697-a478-12bb31712d33/ SHA-256: bae8b16f2df4141a19a32f89a1421d82b3449a4d91ddb254e6421fb573a5537c - URLScan · 2026-10-02: https://screenshots.phishdestroy.io/us/01a0faef-cc75-724b-9985-4a0bf6570fe1.png Captured: 2026-10-02 04:47:09 UTC Source report: https://urlscan.io/result/01a0faef-cc75-724b-9985-4a0bf6570fe1/ SHA-256: 8cbe5edc54f97b1afa86445668bdfcef76d0f4f5a5d77c47f980700c15f6d8d9 - URLScan · 2026-10-03: https://screenshots.phishdestroy.io/us/01a102a1-6302-707c-999a-23627ccfbe58.png Captured: 2026-10-03 16:38:18 UTC Source report: https://urlscan.io/result/01a102a1-6302-707c-999a-23627ccfbe58/ SHA-256: 8cbe5edc54f97b1afa86445668bdfcef76d0f4f5a5d77c47f980700c15f6d8d9 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T19:34:11Z", "uuid": "01a102a0-2652-73e4-a81a-21ec851e3672", "scanned_at": "2026-10-03T16:37:00Z", "final_url": "http://blinda.it/admin-aruba/index.html", "status": 200, "redirects": [ { "to": "https://blinda.it/admin-aruba/index.html", "from": "http://blinda.it/admin-aruba/index.html", "status": 307 }, { "to": "http://blinda.it/admin-aruba/index.html", "from": "https://blinda.it/admin-aruba/index.html", "status": 307 } ], "ip": "89.46.110.68", "ptr": "webx1466.aruba.it", "ips": [ "89.46.110.68" ], "asns": [ "31034" ], "countries": [ "IT" ], "link_domains": [ "aruba.it", "assistenza.aruba.it" ], "doc_hash": "21b87e44e5f8f9e88cfb169943b9d1ecfbda803c6f3033820ea05b75cb12b7ff", "domain_age_days": 2717, "apex_age_days": 2717, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 45, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "aruba-proxy", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T19:41:35Z", "uuid": "c4966726-ff42-4b7d-b5bd-964701a60651", "scanned_at": "2026-10-03T17:09:22Z", "final_url": "https://blinda.it/", "history": [ { "url": "https://blinda.it/", "status": 0 } ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "blinda.it", "type": "A", "value": "89.46.110.68" }, { "name": "blinda.it", "type": "AAAA", "value": "2a00:6d40:4:1::c317:68" } ], "dnssec_valid": false, "whois": { "registrar": "ARUBA-REG", "created": "2001-09-27T00:00:00Z", "updated": "2026-08-21T00:46:23Z", "expires": "2027-08-05T00:00:00Z", "nameservers": [ "dns.technorail.com", "dns2.technorail.com", "dns3.arubadns.net", "dns4.arubadns.cz" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T14:46:06Z", "analysis_at": "2026-10-14T02:00:08Z", "stats": { "timeout": 0, "harmless": 52, "malicious": 5, "suspicious": 0, "undetected": 35 }, "detections": { "CRDF": "malicious", "SOCRadar": "phishing", "Gridinsoft": "phishing", "alphaMountain.ai": "malicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Business/Economy, Malicious (alphaMountain.ai)" }, "popularity": { "Alexa": 469048, "Statvoo": 469048, "Cisco Umbrella": 989043 }, "first_seen": "2023-11-03T11:29:38Z", "dns": [ { "ttl": 3600, "type": "A", "value": "89.46.110.68" }, { "ttl": 3600, "type": "MX", "value": "mx.blinda.it", "priority": 10 }, { "ttl": 3600, "type": "NS", "value": "dns3.arubadns.net" }, { "ttl": 3600, "type": "NS", "value": "dns.technorail.com" }, { "ttl": 3600, "type": "NS", "value": "dns2.technorail.com" }, { "ttl": 3600, "type": "TXT", "value": "v=spf1 include:aruba.it ~all" }, { "ttl": 3600, "type": "AAAA", "value": "2a00:6d40:4:1::c317:68" }, { "ttl": 3600, "type": "NS", "value": "dns4.arubadns.cz" }, { "ttl": 3600, "type": "SOA", "rname": "hostmaster.blinda.it", "value": "dns.technorail.com" } ], "dns_at": "2026-10-14T02:00:23Z", "jarm": "29d3fd00029d29d00042d43d0000002059a3b916699461c5923779b77cf06b", "cert": { "san": [ "*.blinda.it", "blinda.it" ], "issuer": "Actalis S.p.A. / Actalis Domain Validation Server CA G3", "serial": "279ca2deb1737d7cb9843b3203d8fbaf", "sha256": "6f7732225c4c169d32788bdbcbf6de9d68c0b65d5e24e149a0eff730a0ba00da", "subject": "*.blinda.it", "valid_to": "2027-02-26T04:03:13Z", "valid_from": "2026-01-26T04:03:14Z" }, "whois": { "dnssec": "yes" } } } ```