azmicounselinghousesa[.]icu[.]s-italiano[.]store

This domain, azmicounselinghousesa.icu.s-italiano.store, was observed resolving to the IPv4 address 45.141.59.165, which belongs to AS213373 IP Connect Inc and is geolocated in the Netherlands. The domain was registered through NameCheap, Inc. on July 29, 2025, and is served by the authoritative nameservers ns1.amsterdam-hosting.to and ns2.amsterdam-hosting.to. No TLS certificate was presented during connection attempts, indicating the site operated without encryption. Public analysis on VirusTotal shows that five of ninety‑five scanning engines flagged the domain, suggesting at least a subset of security products identified malicious behavior. The domain appears on a single external blocklist and is specifically listed by PhishDestroy as a known phishing resource.

The only HTTP response captured displayed the page title “Account Suspended”, which aligns with the reported scam type of an account‑takeover operation. Current monitoring indicates the site has been taken offline, and the blocklist entry reflects that status. Uncertainty remains regarding the payload or credential‑harvesting mechanisms that may have been hosted before takedown, as no detailed page content or malware samples have been published. The lack of an SSL certificate prevents verification of any credential submission over encrypted channels, and the limited blocklist presence means the domain may have escaped broader detection until recent reporting.

Defenders should immediately add the domain and its resolving IP address to network‑level deny lists and enforce DNS filtering to prevent client resolution. Continuous monitoring of the associated nameservers and the AS213373 prefix is advised, as threat actors often reuse hosting infrastructure for new campaigns. Organizations should also audit any authentication logs for attempted logins that coincide with the domain’s active period, and consider enforcing multifactor authentication to mitigate potential account‑takeover attempts.