Further to my previous email about AS35196 Ihor hosting Ltd,

IP range  91.212.150.0 - 91.212.150.255 of  AS43350 
appears to be run by the same people and is hosting these phishing websites:

https://affittacamerehereditas[.]xyz/
https://aziendafuscillo[.]xyz/


https://apps.db.ripe.net/db-web-ui/lookup?source=ripe&key=ORG-PIHL2-RIPE&type=organisation