psotalnfo[.]cfd

Analysis of psotalnfo.cfd shows that the domain was registered on 10 Oct 2025 via the registrar Aceville Pte. Ltd. The authoritative name servers are a.dnspod.com, b.dnspod.com and c.dnspod.com. DNS resolution points to 43.165.61.250, an address located in Germany and assigned to AS132203 (Tencent Building, Kejizhongyi Avenue). The hosting IP has been referenced in 16 AlienVault OTX pulses and is currently listed on a single security blocklist. No TLS certificate is presented, indicating the site is served only over HTTP. The page title returned from the host is "Poste Italiane - Servizi postali, finanziari e assicurativi", suggesting an impersonation of the Italian postal service, although the content has not been captured for further verification.

Malware and URL‑reputation scanners on VirusTotal have flagged the domain in 14 of 95 engines, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious classification. The domain has been actively blocked by the PhishDestroy mitigation platform and is presently reported as offline. From the evidence, the infrastructure aligns with a typical credential‑harvesting campaign targeting users of Poste Italiana. Uncertainty remains regarding the exact phishing kit or form used, as no screenshots or HTML samples are available.

Defenders should add 43.165.61.250 to network blocklists, enforce DNS sink‑holing for psotalnfo.cfd and its associated dnspod name servers, and monitor for any outbound connections to the Tencent‑owned ASN. Email security gateways should be tuned to detect references to "Poste Italiane" in URLs or subject lines, and any inbound messages containing the domain should be quarantined. Continuous re‑scanning of the domain after it returns online is recommended to capture any changes in payload or hosting.