server604113[.]nazwa[.]pl

The domain server604113.nazwa.pl is currently classified as a high‑risk impersonation phishing site. Intelligence sources label the activity as generic_phishing with a WordPress impersonation vector. The site returns HTTP 200 and presents a page title identical to the domain name, indicating that no additional branding or target information has been observed. Infrastructure analysis shows the domain resolves to IP 85.128.225.18, hosted in Poland under AS15967 belonging to Nazwa.pl Sp. z o.o. The domain was originally registered on 24 December 1999 through the same registrar, and its authoritative name servers are ns1.nazwa.pl, ns2.nazwa.pl, and ns3.nazwa.pl. The TLS certificate presented is issued to Nazwa.pl Sp. z o.o. (nazwaSSL DV TLS G2 R29 CA), confirming the hosting provider’s involvement but offering no indication of malicious intent. Detection platforms have flagged the domain on multiple blocklists, including PhishDestroy and PhishingDB. VirusTotal scans have resulted in five out of ninety‑five security vendors marking the host as malicious, and Gridinsoft assigns a trust score of zero out of one hundred. The web stack comprises Apache HTTP Server with client‑side libraries such as jQuery, Google Hosted Libraries, and Google Analytics, which are commonly found in compromised or fraudulent sites. Defenders should prioritize the immediate inclusion of server604113.nazwa.pl in network‑level deny lists and email gateway filters, as the domain is actively serving content and is associated with a confirmed phishing campaign. Continuous monitoring of the IP address 85.128.225.18 for any changes in reputation or new indicator sets is advised. Analysts should also watch for future TLS certificate updates or alterations to the hosting infrastructure that could signal a shift in operational tactics.