cyberduck[.]it

This domain is flagged as a high-risk phishing site designed to impersonate the legitimate Cyberduck FTP client. Analysis indicates the threat type is brand impersonation, specifically targeting users seeking free FTP software by mimicking the official Cyberduck application. The page title, 'Cyberduck il miglior FTP gratuito - cyberduck.it,' reinforces this deception, likely aiming to harvest login credentials or distribute malicious payloads under the guise of a trusted tool.

Infrastructure analysis reveals the domain was registered on March 17, 2010, through TLD Registrar Solutions Ltd, though its malicious activity appears recent. It resolves to the IP address 35.214.148.249 and currently holds a VirusTotal detection score of 2/95 security vendors. The domain is actively blocked by two security blocklists: OISD and Hagezi. The SSL certificate is issued by Let's Encrypt, a common tactic to lend false legitimacy to phishing sites. Despite its long registration history, the domain's sudden appearance on threat intelligence feeds suggests a compromise or repurposing for malicious intent.

Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (35.214.148.249) at the network perimeter. Users should be advised to verify the authenticity of software downloads by accessing the official vendor site directly, avoiding third-party mirrors or unofficial domains. Security teams should monitor for credential theft attempts or unauthorized access originating from systems that interacted with this domain. If the domain was accessed, reset any credentials entered and scan for malware. Organizations should also review logs for connections to 35.214.148.249 or related indicators to assess potential compromise.