hudatechsolutionsha[.]website[.]s-italiano[.]store

The domain hudatechsolutionsha.website.s-italiano.store was observed targeting Facebook users through a cryptocurrency‑draining campaign. The authoritative registration record shows the domain was created on 29 July 2025 and is registered with NameCheap, Inc. Infrastructure analysis reveals that the domain resolves to IP address 45.141.59.165, which belongs to AS213373 (IP Connect Inc.) and is geolocated in the Netherlands. The hosting nameservers ns1.amsterdam-hosting.to and ns2.amsterdam-hosting.to are consistent with the observed hosting provider. No TLS certificate is presented for the site, indicating that communications would occur over plain HTTP.

The page title returned by the server is “Huda Tech Solutions HA”, which does not reference the impersonated brand, but the threat intelligence tag identifies the campaign as a Facebook impersonation. VirusTotal scans show that five of ninety‑five security vendors flagged the domain, and the Gridinsoft trust score is 0 / 100, reflecting a high likelihood of malicious intent. The domain appears on a single public blocklist and has been actively blocked by PhishDestroy. The overall risk level is elevated, and the current operational status is offline, suggesting that the phishing infrastructure has been taken down or is temporarily inactive.

Defenders should continue to enforce DNS‑level deny‑list rules for the IP address and the domain, monitor for re‑registration, and ensure that any residual traffic is tunneled to a sinkhole for analysis. Additional investigation of the hosting provider and the AS may reveal related malicious infrastructure. Because the site lacks an SSL certificate, any future activation would be easily identifiable by the absence of HTTPS, providing an additional indicator for detection.