easyacademy[.]pk

This domain, easyacademy.pk, was taken offline as of the report date, but multiple indicators show it was previously used for a generic phishing campaign. The domain was registered on 26 January 2024 and resolves to the IPv4 address 207.180.245.8, which belongs to AS51167 operated by Contabo GmbH in France. No TLS certificate is presented, indicating that any traffic would have been unencrypted. The HTTP response returned a generic directory listing with the title “Index of /”, a pattern often observed in opportunistic phishing or drop sites.

Reputation services rate the domain extremely poorly: Scamadviser assigns a trust score of 1 out of 100, Gridinsoft 0 out of 100, and it appears on at least one public blocklist. VirusTotal scans have flagged the domain in 17 of 95 commercial engines, and AlienVault OTX references the host in 16 separate threat‑intel pulses. PhishDestroy has also listed the domain as blocked. The authoritative nameservers (ns1.soft.legal through ns4.soft.legal) are shared with other suspicious hosts, increasing the chance of collateral compromise.

While the site is currently offline, the underlying IP address and hosting provider remain active and could be reused for future malicious campaigns. Defenders should therefore continue to block the domain and its resolving IP, add the associated ASN to deny‑list policies, and monitor the listed nameservers for new resolutions. Ongoing vigilance is advised, as the low trust scores and multiple detections suggest a high likelihood of abuse, even though the site’s content cannot be inspected in its offline state.