fekrouuun[.]com

The domain fekrouuun.com is currently offline but exhibits multiple indicators consistent with a generic phishing operation. The site was registered on October 16, 2025 through DropCatch.com 420 LLC and uses the NameBright DNS nameservers ns1.namebrightdns.com and ns2.namebrightdns.com. No SSL certificate is presented, and the HTTP response returns a generic "NameBright - Coming Soon" page title, suggesting the domain may be in a placeholder state or deliberately presenting a minimalist landing page to avoid content inspection. Scamadviser assigns a trust score of 1 / 100, reflecting an extreme lack of credibility.

The domain appears on a single security blocklist and is listed in two AlienVault OTX threat pulses, indicating that threat‑intelligence communities have observed malicious activity linked to this host. Google Safe Browsing flags the domain for social engineering, and PhishDestroy has actively blocked it, reinforcing the classification as a phishing vector. VirusTotal analysis shows 19 of 95 scanning engines flagging the domain, providing further technical confirmation of malicious intent. The domain resolves to IP address 54.84.240.235, which belongs to Amazon.com, Inc. (AS14618) and is geolocated in the United States, a common hosting environment for disposable or compromised infrastructure used in phishing campaigns.

While the offline status prevents real‑time content verification, the combination of low trust score, lack of encryption, placeholder page title, multiple vendor detections, and inclusion on blocklists offers a clear risk profile. Defenders should continue to block fekrouuun.com at network perimeter and DNS layers, monitor any future re‑activation of the domain, and consider adding the associated IP to deny lists. Additional investigation should focus on any recent traffic logs that reference the domain or its IP, and on correlating the OTX pulses for potential campaign patterns.