albertlee-rewards[.]com

Analysis of albertlee-rewards.com, created on July 23 2026 and hosted on IP 50.28.17.143, shows infrastructure consistent with a newly registered phishing site. The domain is registered through GoDaddy.com, LLC and uses Liquid Web name servers (ns.liquidweb.com, ns1.liquidweb.com). Service fingerprints indicate a Plesk control panel front‑ending an Nginx web server, and outbound email is routed through Sendgrid. The domain appears on one security blocklist and is actively blocked by PhishDestroy, confirming that at least one reputable anti‑phishing feed has flagged it.

VirusTotal has recorded 91 vendor scans with no detections, but the absence of detections does not constitute a safety assurance. No additional public threat intel (e.g., OTX, Safe Browsing) is currently linked to the domain, and no SSL certificate details or HTTP response codes have been disclosed. Given the short lifespan of the domain and its immediate appearance on a blocklist, threat actors likely deployed it for a targeted credential‑harvesting campaign within days of registration. Consequently, the primary evidence for malicious intent consists of its recent creation date, association with a known blocklist, and the presence of email‑relay infrastructure commonly abused for phishing campaigns.

Defenders should add the domain to internal block lists, monitor DNS queries for the 50.28.17.143 address, and enforce outbound email filtering for messages originating from the associated Sendgrid account. Network defenders should also correlate any login attempts or credential submissions to internal services with this domain and isolate compromised accounts promptly. Continuous re‑evaluation is advised, as further analysis (e.g., page content, SSL inspection) may reveal additional indicators of compromise.