fennia[.]listanascita[.]shop

Analysis indicates that the domain fennia.listanascita.shop has been taken offline but remains listed on multiple security blocklists. The site was registered on 23 April 2025 through Tucows Domains Inc. and resolves to IP address 62.60.226.175, which is assigned to AS214351 FEMO IT SOLUTIONS LIMITED in Germany. The domain uses Cloudflare’s authoritative nameservers jake.ns.cloudflare.com and ruth.ns.cloudflare.com, a common choice for fast‑flux or short‑lived malicious infrastructure. No TLS certificate is present, meaning any traffic would be unencrypted HTTP.

VirusTotal reports that two of ninety‑five scanning engines flagged the domain, and the domain appears on one public blocklist, confirming its malicious reputation. Gridinsoft assigns a trust score of 0 out of 100, and the page title returned by the server is “Fennia”, which does not correspond to the advertised brand. The intelligence tags the campaign as a Google brand impersonation, consistent with the “brand impersonation” scam type. The domain has been blocked by the PhishDestroy service, further indicating that it was used for phishing‑related activity.

Because the site is currently offline, active probing is not possible, but the infrastructure details—German IP, Cloudflare nameservers, lack of SSL, and low trust score—are typical of short‑lived impersonation campaigns. Defenders should continue to block the IP address and domain at perimeter defenses, add the domain to internal phishing blocklists, and monitor the associated IP range for re‑use. Periodic re‑resolution of the domain is advised in case the actors reactivate the site, and any future HTTP responses should be inspected for credential‑stealing forms or redirects to known Google login endpoints.