buff163[.]paccofacile[.]com

The domain buff163.paccofacile.com is currently classified as a high‑risk generic phishing site. It was registered on 21 February 2026 through Dynadot LLC and has been active since its creation. The short lifespan combined with the active status aligns with typical phishing infrastructure that is rapidly deployed to exploit current campaigns.

Infrastructure analysis shows the domain resolves to IP 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The host is fronted by Cloudflare and serves traffic over HTTP/3 with HSTS enforced. TLS is provided by a Let’s Encrypt R13 certificate, and the site includes Google Tag Manager scripts. DNS is delegated to 230.ns1.above.com and 230.ns2.above.com. A HTTP 302 redirect delivers a page whose title is “paccofacile.com”, suggesting a possible attempt to hide the malicious landing page behind a legitimate‑sounding name.

Threat intelligence corroborates the malicious intent. VirusTotal scans have flagged the domain in 9 out of 95 security vendors, and the Gridinsoft trust score is 0 / 100, indicating a complete lack of reputation. The domain appears on one external blocklist and has already been blocked by PhishDestroy, reinforcing the high‑risk assessment. These independent signals collectively confirm that the domain is being used for phishing activities.

Defenders should immediately block DNS resolution for buff163.paccofacile.com and any sub‑domains, and enforce outbound filtering to prevent connections to its IP address. Network monitoring should include alerts for HTTP 302 redirects to the “paccofacile.com” title page, and security appliances should be updated with the observed Cloudflare and Let’s Encrypt fingerprint details. Ongoing threat hunting should verify whether credentials or session cookies are being harvested, and any compromised accounts should be forced to reset passwords.