intesasanpaoloit[.]it

This domain, intesasanpaoloit.it, is a confirmed credential harvesting site designed to impersonate Facebook. Attackers use such domains to trick users into entering their login details, which are then captured for unauthorized access to accounts, financial fraud, or further phishing campaigns. The site mimics legitimate branding to deceive victims, often through fake login portals or alerts claiming account issues. Analysis indicates the domain was registered on December 09, 2025, through Register S.p.a., a registrar frequently associated with malicious infrastructure. It resolves to the IP address 213.158.93.26, hosted in Belgium under AS34762 (Combell NV). The absence of an SSL certificate further confirms its fraudulent nature, as legitimate services enforce encryption. Security vendors flagged the domain in 22 out of 95 scans on VirusTotal, and it appears on two active blocklists, including PhishDestroy and PhishingDB. If you visited intesasanpaoloit.it or entered credentials, immediately change your Facebook password and enable multi-factor authentication. Check your account for unauthorized activity, such as unfamiliar logins or posts. Report the incident to your organization’s security team if accessed on a work device. Avoid interacting with any links or emails associated with this domain, and verify website authenticity by inspecting URLs for misspellings or unusual characters before entering sensitive information.