cncbuildsaustralia[.]com

The domain cncbuildsaustralia.com was registered on April 26, 2026 through the registrar Gransy, s.r.o. It is configured with the authoritative name servers ns1.freednsdedi.com and ns2.freednsdedi.com and serves an HTTPS site signed by a DigiCert Inc / RapidSSL TLS RSA CA G1 certificate. The site returns HTTP 200 and presents the page title “Home - CNC Builds Australia,” indicating an attempt to masquerade as a legitimate business front.

Infrastructure analysis shows the domain resolves to the IPv4 address 185.255.122.94, which is hosted by BeeHosted in Ukraine and listed under the ISP BeeHosted - Internet Services & Hosting Provider. The host’s Gridinsoft trust score is 0 out of 100, reflecting a severely low reputation. The domain appears on three public security blocklists, including PhishDestroy, MetaMask, and SEAL, suggesting prior detection by anti‑phishing feeds.

Detection metrics reveal that 2 of 95 security vendors on VirusTotal flagged the domain, while AlienVault OTX references the domain in a single threat‑intelligence pulse. The low detection count does not mitigate the high‑risk classification, as the domain’s active status and the presence of a valid SSL certificate enable credential‑harvesting pages to appear trustworthy to unsuspecting users. The combination of a recent registration, low trust score, and blocklist listings aligns with typical characteristics of a newly deployed phishing infrastructure.

Uncertainty remains regarding the full scope of the phishing campaign, including the specific target audience and any associated command‑and‑control infrastructure. Defenders should block the domain at perimeter firewalls, update DNS filtering policies to deny resolution of 185.255.122.94, and monitor for any outbound connections to the hosting provider. Continuous re‑evaluation of VirusTotal and other vendor feeds is advised, as additional detections may emerge as the campaign progresses.