my[.]dijital-borsa[.]com

The domain my.dijital-borsa.com was observed on July 12, 2026 delivering a credential phishing campaign that mimics the Dijitalbors service, as indicated by the page title “Login | Dijitalbors”. The site issues an HTTP 302 response, redirecting visitors to a login endpoint designed to capture credentials. Classified as generic_phishing, the campaign carries a high risk rating and is currently active.

Infrastructure analysis shows the domain resolves to IP address 89.124.79.159, which is geolocated to the Netherlands and operated by Servers Tech Fzco. Registration was performed through CNOBIN INFORMATION TECHNOLOGY LIMITED on March 22, 2026, and the authoritative nameservers are laylah.ns.cloudflare.com and lee.ns.cloudflare.com, indicating Cloudflare DNS hosting. The web server presents a Let’s Encrypt certificate (E8) and runs a stack comprising PHP, Ubuntu, Nginx, Inertia.js, Alpine.js, jQuery, and cdnjs, all behind Cloudflare’s reverse‑proxy service.

Threat assessment is reinforced by a Gridinsoft trust score of 0 out of 100, reflecting an extremely low confidence in the site’s legitimacy. VirusTotal analysis recorded a single detection out of ninety‑five security vendors, and the domain is listed on one external blocklist maintained by PhishDestroy. These signals, combined with the observed HTTP 302 redirection and the credential‑phishing classification, substantiate the high‑risk designation.

Defenders should block the domain and its associated IP address at network perimeters and update endpoint protection signatures to include the observed indicators. Monitoring of DNS queries for the Cloudflare nameservers may reveal additional malicious domains sharing the same infrastructure. Continuous re‑evaluation of the domain’s status is advised, as the active nature of the campaign suggests ongoing attempts to harvest credentials from unsuspecting users.