presales[.]assetinsights[.]co[.]uk

presales.assetinsights.co.uk was observed hosting a generic phishing page as of 12 July 2026. The domain was registered on 23 April 2026 through 123‑Reg Limited and resolves to the Google Cloud host 35.214.23.206 in the europe‑west2 region. The web server returns HTTP 403 and displays the default virtual‑host title “This is the default server vhost”. TLS is supplied by a Let’s Encrypt R12 certificate, and the authoritative nameservers are ns29.domaincontrol.com. and ns30.domaincontrol.com. Gridinsoft assigned a trust score of 0 / 100, and the domain appears on a single security blocklist, currently blocked by PhishDestroy. VirusTotal reports 0 / 95 detections, indicating the site has not yet been flagged by that engine.

Analysis indicates the infrastructure is typical of short‑lived phishing operations: a recent registration, low trust score, and hosting on a major cloud provider. The HTTP 403 response suggests the content may be hidden behind authentication checks or served only to targeted users, which limits immediate visual verification of the phishing payload. No specific credential‑stealing page or lure has been captured, and the exact victim‑facing URL path remains unknown. Consequently, the full scope of the campaign—such as targeted brands, credential types, or distribution vectors—cannot be conclusively determined at this stage.

Defenders should add 35.214.23.206 to network blocklists and enforce DNS filtering for presales.assetinsights.co.uk. Monitoring of outbound connections to the Google Cloud europe‑west2 region for anomalous traffic patterns is advisable. Organizations using email filtering should flag any messages that reference the domain or its subdomains, even though the visible page title is generic. Continuous re‑scanning of the domain on multi‑engine platforms is recommended, as the site may evolve to host malicious payloads or trigger detections in the future.