cerebroconsulting[.]ro

The domain cerebroconsulting.ro is currently active and has been classified as a high‑risk banking phishing site. Risk level is marked high, and the threat type is generic_phishing with a specific focus on banking credential harvesting. The page title returned by the web server reads “Web Hosted by Hostico,” indicating no overt brand spoofing in the title.

The domain was registered on May 10 2023 through Awesome Projects SRL and is hosted on the IPv4 address 188.241.222.53, which belongs to AS5606 GTS Telecom SRL in Romania. All four authoritative name servers (ns1.hostico.ro through ns4.hostico.ro) resolve to the same provider, and the service is delivered via Apache HTTP Server. A valid Let's Encrypt R12 certificate is presented, confirming TLS encryption but offering no assurance of legitimacy.

Multiple security feeds have flagged the domain. VirusTotal reports 16 out of 95 scanners flagging it, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on PhishDestroy and PhishingDB blocklists, and Google Safe Browsing lists it under “SOCIAL_ENGINEERING.” AlienVault OTX references the domain in 18 threat‑intelligence pulses, reinforcing its association with ongoing phishing campaigns.

Defenders should treat cerebroconsulting.ro as a confirmed malicious endpoint. Immediate actions include adding the domain and its resolving IP to network‑level deny lists, updating URL filtering policies, and monitoring DNS queries for any internal resolution attempts. Because the actual landing page content has not been publicly analyzed, further sandbox inspection is advised to capture any payloads or credential‑stealing mechanisms that may be delivered after initial connection.