vip[.]163[.]eurodelikatese[.]com

Analysis of vip.163.eurodelikatese.com indicates that the domain is currently offline but previously returned HTTP 200 responses, suggesting an operational web service before takedown. The site presented the page title “163网易免费邮--中文邮箱第一品牌”, directly referencing the 163.cn brand, and is classified as a brand‑impersonation campaign targeting the Chinese email service. The domain resolves to IP 185.58.73.251, which is assigned to AS201563 (cyber_Folks d.o.o) located in Croatia. Hosting is fronted by LiteSpeed with HTTP/3 enabled, and the TLS certificate is a Let’s Encrypt R12 certificate, indicating recent certificate issuance but not necessarily legitimate ownership. Nameserver resolution points to dns1.cdn.hr and dns2.cdn.hr, both hosted in the same HR network, reinforcing the geographic correlation.

Registration data shows the domain was created on 10 May 2011 through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently observed in malicious deployments. The domain appears on a single security blocklist and has been flagged by 15 of 95 security vendors on VirusTotal, providing moderate detection confidence. PhishDestroy has already blocked the domain, reducing immediate exposure. Uncertainty remains regarding the current infrastructure after the offline status; no live page content can be verified, and the exact phishing kit or credential‑capture mechanism is not disclosed.

Defenders should continue to enforce blocklisting of the domain and its associated IP address, monitor for any re‑registration or resurrection of the host, and incorporate the observed TLS fingerprint and name server patterns into detection rules. Additional scrutiny of outbound traffic to the HR ASN and any DNS queries for the domain is advisable. Because the domain mimics a well‑known Chinese email brand, email security gateways should be tuned to flag similar brand‑specific page titles and to validate TLS certificates against known legitimate 163.cn endpoints.