antai-gouv-fr[.]stavbazdreva[.]sk

Analysis of antai-gouv-fr.stavbazdreva.sk shows that the domain was registered on March 24, 2024 through Websupport s.r.o. The authoritative nameservers ns1.websupport.sk, ns2.websupport.sk and ns3.websupport.sk resolve the host to the IPv6 address 2a00:4b40:aaaa:2009::6, which belongs to AS51013 operated by WebSupport in Slovakia. The web server identified by banner inspection runs Nginx with the OpenResty module, and the TLS certificate presented is a Let’s Encrypt R12 certificate, indicating a legitimate‑looking encryption layer. An HTTP request to the root path returns a 404 status code and the page title returned by the server is “Registrácia domén, hosting a servery :: WebSupport.sk”, a generic hosting service message rather than a targeted brand page.

Google Safe Browsing classifies the URL as a social engineering threat, and the domain appears on one external blocklist and is actively blocked by the PhishDestroy feed. VirusTotal analysis flags the domain on 15 of 95 scanned security engines, reinforcing the suspicion of malicious use. The current operational status is offline, suggesting the site has been taken down or is no longer serving content.

The available evidence confirms that the domain is being used for a generic phishing campaign, but the specific brand or service being spoofed has not been observed in the collected metadata. Defenders should add the IPv6 address and the full domain to network and endpoint blocklists, enforce DNS filtering for the domain, and monitor for any resurgence of activity from the same hosting provider or IP range. Continuous re‑scanning of the domain and its hosting infrastructure is recommended, as the offline status may change and additional payloads could be deployed if the site is re‑activated.