# PhishDestroy domain threat record: mail1.libero.it

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mail1.libero.it/
Machine-readable companion: https://phishdestroy.io/domain/mail1.libero.it/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-16 04:40:08 UTC
- Last availability or vendor check: 2026-10-22 10:29:24 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 1/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 213.209.0.20
- Registrar in stored WHOIS data: Reevo s.p.a.
- Last stored HTTP status: 302

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/mail1.libero.it
- Certificate Transparency search: https://crt.sh/?q=%25.mail1.libero.it
- Web Archive lookup: https://web.archive.org/web/*/https://mail1.libero.it/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
mail1.libero.it is a mail-named host under the libero.it domain that PhishDestroy added to its blocklist on 2026-09-16. It has not been assigned a specific scheme type, and no impersonated brand or targeted audience has been established beyond what the hostname suggests. As of 2026-10-19 the site was alive and answering visitors with a redirect rather than serving a page of its own.

How the scam works
The page title is simply "302 Found", a standard HTTP response that forwards the browser elsewhere. The title therefore reveals nothing about the final destination, and no login form or wallet prompt has been documented. The risk to watch for is a mail-named address passing visitors on to a page that asks for credentials. Anyone who lands on a sign-in screen after following this host should treat the request for a username and password with caution.

Evidence
Independent support for the listing is thin. On 2026-10-03, one of 91 VirusTotal engines (URLQuery) flagged the host, and the other 90 returned no detection. PhishDestroy is the only blocklist carrying it. A single vendor hit is weak evidence, so readers should treat this as a precautionary listing rather than a confirmed phishing operation.

Infrastructure
The host resolves to 213.209.0.20 on the Italiaonline S.p.A. network in Italy, and the domain is registered through Reevo s.p.a. Its certificate is an organization-validated certificate from Sectigo. That level of validation requires the certificate authority to verify a named organization, which is more vetting than a typical throwaway phishing host receives. Taken together, the Italian hosting, the registrar and the validated certificate point to an established operator rather than freshly built scam infrastructure.

What to do
If you followed a link through this host and then entered your mail password, change it from a bookmarked or typed address and turn on two-factor authentication. Check your account for forwarding rules or sessions you do not recognize. Defenders should log and review traffic to this host, especially where it leads to credential pages. Given the single detection, they should weigh blocking against the likelihood of a false positive and report confirmed misuse to the network operator.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/mail1.libero.it
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mail1.libero.it
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:47:25 UTC

## Stored page captures

- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/90f9189b-b0e3-4eb0-addb-53b752c29b5b.png
  Captured: 2026-09-23 03:03:06 UTC
  Source report: https://radar.cloudflare.com/scan/90f9189b-b0e3-4eb0-addb-53b752c29b5b
  SHA-256: be8cb08fc0156d29e67a49b32f5769d6a51d7dbbf6f1d5ce6cb9e0c2251797e7

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:30:00Z",
        "uuid": "90f9189b-b0e3-4eb0-addb-53b752c29b5b",
        "scanned_at": "2026-09-23T03:03:06Z",
        "final_url": "https://mail1.libero.it/appsuite/",
        "status": 200,
        "redirected": "same-domain",
        "history": [
            {
                "url": "https://mail1.libero.it/",
                "status": 302
            },
            {
                "url": "http://mail1.libero.it/appsuite/",
                "status": 307
            },
            {
                "url": "https://mail1.libero.it/appsuite/",
                "status": 200
            }
        ],
        "dom_hash": "8d2c8fb5fe129c36cd8d698cafe8f2f0e03852897f972fd97482f08e39213725",
        "doc_hash": "6c4c9bd88b4cdc180c447261200579d771d50c7de369b3a18bc6a42fae9dbf24",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mail1.libero.it",
                "type": "A",
                "value": "213.209.0.20"
            }
        ],
        "dnssec_valid": false,
        "ip": "213.209.0.20",
        "whois": {
            "registrar": "IOL-REG",
            "created": "1999-06-03T00:00:00Z",
            "updated": "2026-06-19T00:51:22Z",
            "expires": "2027-06-03T00:00:00Z",
            "nameservers": [
                "ns1.italiaonline.it",
                "ns2.iol.it"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T00:30:34Z",
        "analysis_at": "2026-10-14T13:22:26Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 36
        },
        "reputation": 0,
        "popularity": {
            "Cisco Umbrella": 136324
        },
        "first_seen": "2023-09-28T20:04:06Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "A",
                "value": "213.209.0.20"
            }
        ],
        "dns_at": "2026-10-14T13:22:44Z",
        "jarm": "29d29d00000000000041d41d00041da2ef8628b895cf67790015cc09f2affc",
        "cert": {
            "san": [
                "*.libero.it",
                "libero.it"
            ],
            "issuer": "Sectigo Limited / Sectigo Public Server Authentication CA OV R36",
            "serial": "f910591b0ca71b086ec4cda05d0de89f",
            "sha256": "616f7e8014a268eb4c479d36b9ef00a218014dea965d8c4d54504b398ec3d77e",
            "subject": "*.libero.it",
            "valid_to": "2027-01-08T23:59:59Z",
            "valid_from": "2026-06-24T00:00:00Z"
        },
        "whois": {
            "dnssec": "no"
        }
    }
}
```