firma-itau[.]de

This domain is flagged as a high-risk credential theft operation targeting Itaú Bank customers. Analysis indicates the site is designed to mimic legitimate banking portals, tricking users into submitting login credentials, which are then harvested by threat actors for financial fraud or account takeover. The specific threat type is credential theft, with a focus on financial services impersonation. Infrastructure analysis reveals the domain firma-itau.de is hosted on IP 213.133.104.92, located in Germany under AS24940 (Hetzner Online GmbH). It is currently active and resolves to this IP, with a Let's Encrypt SSL certificate issued under the YR2 configuration. Detection data shows 1 out of 95 security vendors on VirusTotal flag the domain as malicious. The domain appears on one security blocklist and is blocked by PhishDestroy. The page title displays 'Maintenance,' a common tactic to disguise malicious activity as temporary downtime while harvesting credentials. Mitigation steps for this credential theft threat include immediate blocking of the domain and its associated IP at the network perimeter. Financial institutions and users should be alerted to verify URLs before entering credentials, particularly for Itaú Bank-related sites. Security teams should monitor for unusual login attempts or authentication anomalies linked to this domain. If credentials were entered on this site, affected accounts must be locked, passwords reset, and multi-factor authentication enforced. Network logs should be reviewed for connections to 213.133.104.92 or related indicators to identify compromised systems.