mail[.]info-signere-digitilsynet[.]com

This domain, mail.info-signere-digitilsynet.com, is identified as a high-risk phishing infrastructure targeting users through brand impersonation. Analysis indicates the threat type is a fake login portal mimicking BankID, a widely used electronic identification system. The page title explicitly displays 'BankID,' suggesting an attempt to deceive users into entering credentials under the guise of legitimate authentication. No evidence of a crypto drainer kit or secondary payload delivery was observed in initial scans, though credential harvesting remains the primary objective. Infrastructure analysis reveals precise technical indicators: the domain was registered on March 08, 2026, through OwnRegistrar, Inc., an entity frequently associated with suspicious registrations. It resolves to the IP address 193.24.123.124, geolocated in Russia under AS200593 (PROSPERO OOO). VirusTotal reports 27 out of 95 security vendors flagging the domain as malicious. Google Safe Browsing has classified the domain as phishing, and it appears on at least one security blocklist, specifically PhishDestroy. The creation date discrepancy—registered in 2026—suggests either a typographical error in WHOIS data or intentional manipulation to evade temporal detection heuristics. As of the latest verification, the domain has been taken offline, likely following abuse reports or hosting provider intervention. While the immediate threat is mitigated, residual risk persists due to potential DNS cache retention or delayed blocklist propagation. Users who accessed the domain prior to takedown should assume credential compromise and initiate password resets for associated accounts. Organizations are advised to monitor for secondary domains registered under the same registrar or resolving to the same IP infrastructure, as threat actors often reuse hosting providers and naming conventions across campaigns. Proactive measures include blocking the IP 193.24.123.124 at the network perimeter and alerting users to the BankID impersonation tactic.