simon-fidan[.]nl

This domain, simon-fidan.nl, is identified as a credential harvesting phishing site designed to mimic legitimate login portals and capture user credentials. Analysis indicates no direct association with a specific brand or drainer kit, though the infrastructure aligns with common phishing frameworks leveraging Let’s Encrypt SSL certificates for perceived legitimacy. The domain exhibits characteristics typical of large-scale phishing campaigns, including rapid deployment and short operational lifespans before takedowns. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IPv6 address 2a10:b5c1:119::1, hosted on a Netherlands-based network (AS60781, LeaseWeb Netherlands B.V.). It was registered on February 21, 2026, through Realtime Register, an uncommon future date suggesting potential data manipulation or a placeholder in threat intelligence feeds. The SSL certificate is issued by Let’s Encrypt (serial number E7), a frequent choice for phishing sites due to its free and automated issuance process. At the time of assessment, the domain was flagged by 12 out of 95 security vendors on VirusTotal, with additional listings on two security blocklists, including PhishDestroy and PhishingDB. Google Safe Browsing (GSB) status is not explicitly provided but is inferred as blocked given the offline status. The domain is currently offline, likely due to takedown actions by hosting providers or registrars following abuse reports. However, the elevated risk level persists due to the domain’s recent creation and historical phishing activity. Organizations and end-users are advised to block the domain and its associated IP address at the network level. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP space, as threat actors often reuse infrastructure. Users who may have interacted with the domain are urged to reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Continuous vigilance is recommended, as phishing campaigns frequently rotate domains and IPs to evade detection.