reall-brrrr-23s[.]free[.]nf

The domain reall-brrrr-23s.free.nf was registered on June 14, 2023 through Key-Systems GmbH and remains active as of the report date, July 25, 2026. Network analysis shows the domain resolves to IP address 185.27.134.252, which is advertised as belonging to AS34119 Wildcard UK Limited in Great Britain. The host is served by the free hosting provider InfinityFree, as indicated by the authoritative nameservers ns1.infinityfree.com and ns2.infinityfree.com. An SSL certificate issued by ZeroSSL (ZeroSSL ECC Domain Secure Site CA) is present, confirming that TLS is in use but offering no indication of legitimacy. HTTP requests to the site return a 200 status code, and the page title is reported as "Verificacion," a generic term that does not reveal further context.

The MX record is set to mx.free.nf with a priority of 5, suggesting that the domain may also be used for email-based lures. VirusTotal scans show that ten of ninety‑three security vendors flagged the domain, indicating a moderate level of detection across independent engines. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the view that it is being used for malicious purposes. A Gridinsoft trust score of 0 out of 100 further reflects a lack of reputation.

The campaign is classified as brand impersonation targeting Outlook, and the risk level is marked high. While the available data confirms the infrastructure and detection status, the exact content of the landing page has not been publicly dissected, leaving the specific phishing workflow uncertain. Defenders should continue to block the domain at DNS and proxy layers, monitor for any outbound connections to the associated IP, and include the domain in email filtering rules, especially for Outlook‑related traffic. Ongoing observation of the IP and any related sub‑domains is advised, as the host may be leveraged for additional malicious payloads or credential‑harvesting attempts.