filereviewsigndocsx[.]sbs

Analysis of filereviewsigndocsx.sbs indicates this domain was a generic phishing site impersonating a PDF viewer service. The domain was registered on August 9, 2025, through NameSilo, LLC, and is currently offline. Infrastructure analysis reveals it resolved to IP address 212.11.64.144, hosted on AS42624 (Global-Data System IT Corporation) in Switzerland. The domain used nameservers ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com, a common pattern observed in phishing infrastructure. No SSL certificate was detected, increasing the likelihood of unencrypted credential harvesting.

The page title was 'PDF Viewer,' suggesting an attempt to mimic legitimate document viewing services. As of the report date, the domain appears on one security blocklist and was flagged in one AlienVault OTX threat intelligence pulse. VirusTotal detections show 15 of 93 security vendors marked it as malicious, though the absence of additional context limits further classification. Gridinsoft assigned a trust score of 0/100, and the domain is blocked by PhishDestroy. Defenders should treat this domain as a confirmed phishing threat.

While the site is offline, the infrastructure remains a potential risk for reuse. Network-level blocks should be implemented for the domain and its resolved IP. Security teams are advised to monitor for related domains using the same nameservers or hosting provider, as these may indicate further phishing campaigns. No brand-specific targeting is confirmed beyond the 'PDF Viewer' page title, so generic phishing detection rules should apply.