bill[.]fast-shipping[.]it

The domain bill.fast-shipping.it is flagged as a credential theft site. It impersonates a legitimate shipping service to trick users into revealing their login credentials. No specific drainer kit is identified, but the domain is designed to capture sensitive information.

Analysis indicates that the domain has a VirusTotal score of 15/95, suggesting that while a significant portion of security vendors recognize the threat, it has not yet been flagged by the majority. The domain was registered with Sectigo Limited, using the Sectigo Public Server Authentication CA DV R36 SSL certificate. It was created on June 03, 2026, and resolves to the IP address 52.209.163.93. The domain appears on 2 security blocklists, including PhishDestroy and PhishingDB, and is currently listed as taken offline.

The current status of bill.fast-shipping.it is offline, which reduces the immediate risk to users. However, the domain could be reactivated at any time. Response actions have included blocking the domain on major security platforms and informing relevant stakeholders. Despite the domain being taken offline, the IP address 52.209.163.93 remains a potential risk and should be monitored. Organizations should update their security policies to block this domain and educate users about the risks of credential theft through phishing sites.