modra-zavarovanlica[.]si

This domain, modra-zavarovanlica.si, is identified as a fraudulent insurance portal designed to impersonate legitimate Slovenian insurance services. Analysis indicates the site employs a generic phishing framework targeting users seeking insurance-related services, likely through credential harvesting or financial data exfiltration. The presence of an Apache2 Debian default page suggests either an incomplete deployment or an attempt to evade detection by serving minimal content while maintaining server infrastructure for malicious redirection or payload delivery. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to 94.127.24.14, hosted on AS21283 (A1 Slovenija telekomunikacijske storitve, d.d.), and was registered on May 28, 2025, through registrar KABI d.o.o. Security vendors on VirusTotal flagged the domain in 11 out of 95 scans, while it appears on two independent security blocklists. The SSL certificate, issued by Let’s Encrypt (serial number E8), provides transport layer encryption but does not mitigate the underlying phishing threat. Detection by PhishDestroy and PhishingDB further corroborates its malicious classification. Users who accessed modra-zavarovanlica.si should immediately revoke any credentials entered on the site, particularly those related to financial or insurance accounts. System-level scans using updated security tools are recommended to detect potential secondary infections or data exfiltration artifacts. Affected parties should monitor linked accounts for unauthorized transactions and report the incident to local cybersecurity authorities or national CERT teams. Domain registrars and hosting providers are advised to review associated infrastructure for additional compromised assets, given the domain’s recent creation date and elevated detection metrics.