confidio-check[.]free[.]nf

This domain confidio-check.free.nf is assessed as a generic phishing infrastructure specifically designed for credential theft. The active lure imitates a payment-related interface associated with Aruba.it Pagamenti, indicating a targeted attempt to harvest sensitive login or payment credentials. Current status is taken offline, but historical indicators confirm malicious intent.

Technical telemetry shows multiple corroborating risk signals. The domain was created on June 14, 2023 and is registered through Key-Systems GmbH. It resolves to IP 185.27.133.13 and uses a Let's Encrypt SSL certificate. VirusTotal analysis reports 9/95 security vendors flagging the domain as malicious. Additionally, the infrastructure appears on 3 security blocklists, including PhishDestroy, PhishingArmy, and OISD. The page title observed is "Pagamenti - Aruba.it", indicating explicit brand impersonation of Aruba.it.

At present, the domain is offline, reducing immediate exposure risk, but historical activity confirms phishing intent. Recommended mitigation includes maintaining blocklist entries for 185.27.133.13 and associated domain patterns, monitoring for reactivation under similar subdomains, and reviewing access logs for any prior user interaction. Any credentials potentially submitted to this endpoint should be considered compromised and reset immediately. Security controls should continue enforcing DNS filtering and heuristic detection for payment-themed impersonation pages.