datifee[.]site

datifee.site was observed as an offline site that had been active as a generic phishing vector. The domain was registered on May 17 2025 through Beget LLC and resolves to the IPv4 address 87.236.16.164, which belongs to AS198610 operated by Beget LLC in Russia. DNS resolution uses four Beget name servers (ns1.beget.com, ns1.beget.pro, ns2.beget.com, ns2.beget.pro). The web server reported a PHP application behind an Nginx front‑end and presented a TLS certificate issued by Let’s Encrypt (R12).

The page title returned by HTTP(S) requests is “Datefi”. Threat intelligence sources have recorded the domain in a single AlienVault OTX pulse and it appears on one public blocklist. PhishDestroy actively blocks the domain, and a Gridinsoft trust score of 0 / 100 reflects a highly malicious reputation. VirusTotal analysis shows that 4 of 93 scanning engines flagged the site, indicating at least partial detection of malicious content.

The current status is taken offline, and no further content is reachable for verification. The available data confirms that the domain was used for phishing, but the specific target brand or credential‑harvesting technique has not been disclosed. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the IP address or associated name servers, and update detection rules to include the observed page title “Datefi” and the combination of PHP/Nginx stack with a Let’s Encrypt certificate on the identified IP range. Additional investigation may be required to determine the exact phishing campaign payloads and victim demographics.