proximusloginauthbe[.]homeftp[.]net

This report details a credential phishing threat hosted at proximusloginauthbe.homeftp.net. The page title, "Site is created successfully!", indicates a default or placeholder page, suggesting the phishing infrastructure may have been set up but was taken offline before full deployment. The domain name, containing "proximusloginauthbe," targets Proximus, a Belgian telecommunications company, by mimicking a login authentication page to steal user credentials. The threat posed is account takeover and potential financial fraud.

Technical evidence shows the site was flagged by 13 out of 95 VirusTotal vendors, with detections from ADMINUSLabs, Criminal IP, alphaMountain.ai, BitDefender, and CyRadar. It appears on 2 blocklists. The IP address 62.4.23.124 is located in France, hosted by AS12876 SCALEWAY S.A.S., with registrar DEDIBOX-CUST-62_4_23_96. No SSL certificate was detected. Creation date is not provided in the data.

The site is currently DOWN/OFFLINE, and GridinSoft trust rating is 0/100, indicating a high-risk threat. The risk level remains elevated due to the domain's targeting of a specific brand and the confirmed phishing activity, though the immediate threat is mitigated by the site's offline status.