re[.]studiobattista[.]eu

On July 24, 2026 the domain re.studiobattista.eu was observed hosting a credential‑phishing page identified by the title “DBS Login”. The site was secured with a Let’s Encrypt certificate issued under the YR2 program, indicating the presence of HTTPS despite its malicious intent. Google Safe Browsing classified the domain twice as social engineering, confirming its use for credential harvesting. VirusTotal recorded nine detections out of ninety‑one scanned engines, and the domain appears on a single external blocklist, showing that multiple security products have flagged it. The hosting infrastructure resolves to 138.226.237.212, an address located in Germany and owned by AS205775 (NEON CORE NETWORK LLC).

Nameserver records point to dns.technorail.com, dns2.technorail.com, and dns4.arubadns.cz, which are typical of the registrar Aruba S.p.A. The site’s trust rating from Gridinsoft is 0 / 100, and it has been actively blocked by the PhishDestroy service. Current network scans indicate the site is offline, but the infrastructure components remain active and could be reused for future campaigns. Defenders should continue to block the domain at DNS and web‑gateway layers, add the associated IP address to reputation lists, and monitor the listed nameservers for new subdomains that may be provisioned under the same registrar. Integration of Google Safe Browsing and VirusTotal APIs into detection pipelines will ensure rapid identification of re‑use.

Because the SSL certificate is publicly trusted, network‑level TLS inspection may be required to uncover malicious payloads. Continuous monitoring of NEON CORE NETWORK LLC’s address space for similar activity is advised, as the attacker may shift to adjacent IPs. Updating intrusion‑prevention signatures with the observed page title “DBS Login” and the low Gridinsoft trust score can reduce false negatives.