stabile-fundex[.]com

The domain stabile-fundex.com is identified as a credential phishing infrastructure targeting users under the guise of a financial service. Analysis indicates the site impersonates an official Italian platform, as suggested by its page title, 'Stabile Fundex | Sito ufficiale in Italia 2026.' The domain is currently offline, but prior activity confirms its use in phishing operations designed to harvest login credentials and sensitive financial information. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NETIM SAS, a registrar frequently associated with abuse reports. It resolves to the IP address 94.26.38.9, hosted under AS202412 (Omegatech LTD) in Bulgaria. The domain is flagged by 8 of 95 security vendors on VirusTotal, including detection by PhishDestroy, and appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites due to its accessibility and short validity periods. Current status confirms the domain has been taken offline, likely following detection and reporting. However, the infrastructure remains a potential risk for re-emergence or reuse in future campaigns. Organizations and users are advised to block the domain and associated IP at perimeter defenses. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range. End-users should verify financial service communications through official channels and avoid interacting with unsolicited links or login prompts.