musiikkiterapiapalvelut[.]fi

The domain musiikkiterapiapalvelut.fi was registered on March 10, 2026, and is currently flagged as an active phishing threat. Analysis indicates the domain resolves to the IP address 91.221.67.85, which is associated with AS51765, a network operated by Oy Creanova Hosting Solutions Ltd. in Finland. The domain uses nameservers dns1.creanova.org, ns1.creanova.org, ns2.creanova.org, and ns3.creanova.org, all of which are linked to the same hosting provider. This infrastructure consistency suggests centralized control, a common trait in phishing operations where threat actors reuse hosting resources for multiple malicious domains. Technical indicators reveal the domain serves content via Nginx with OpenResty, a combination often employed to obfuscate malicious activity behind legitimate web server software. The SSL certificate, issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, is valid but does not mitigate the domain's malicious classification. The HTTP response status is 200, and the page title 'One moment, please...' is a known placeholder used to delay or redirect victims while evading automated detection systems. As of July 12, 2026, the domain remains active and is blocked by two security blocklists, including PhishDestroy and PhishingDB. VirusTotal reports that 15 out of 95 security vendors have flagged musiikkiterapiapalvelut.fi as malicious, reinforcing its classification as a high-risk domain. The specific phishing type is categorized as generic, meaning it likely targets credentials or personal information without mimicking a well-known brand. Defenders should treat this domain as compromised and implement immediate blocking at the DNS or network level. Monitoring for connections to 91.221.67.85 or the associated nameservers may help identify infected systems or ongoing phishing attempts within an organization. Given the domain's recent registration and persistent activity, continued vigilance is advised.