resodanse-salsa[.]ch

Analysis of the domain resodanse-salsa.ch indicates it is actively hosting a phishing site classified as high-risk. The domain, registered on March 29, 2018, resolves to IP address 185.125.27.82 and is currently flagged by two security blocklists, including PhishDestroy and BLP-Malware. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, Yoast SEO, Apache HTTP Server, jQuery Migrate, jQuery, and HSTS, suggesting a compromised or maliciously configured WordPress installation. The page title, 'Accueil - Résodanse Salsa,' does not explicitly indicate a targeted brand, but the site is categorized as generic phishing. Threat intelligence sources report the domain in 50 AlienVault OTX pulses, reinforcing its association with malicious activity. VirusTotal data shows 13 of 95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100. The SSL certificate is issued by Let's Encrypt, which is consistent with both legitimate and malicious sites. No evidence of a specific phishing kit or targeted brand is present in the available data, and the exact content of the phishing page remains unanalyzed. Defenders should treat this domain as hostile and implement blocking at the DNS or network level. Given its inclusion in multiple threat intelligence feeds and active status, monitoring for related indicators of compromise (IOCs) is recommended. Further investigation into the WordPress installation may reveal exploitation vectors or additional malicious payloads.