find-alert-device[.]info

Analysis of find-alert-device.info shows a recently registered domain (created February 17, 2026) that has been taken offline but retains a record of malicious activity. The site was hosted on an Apache HTTP Server and served over HTTPS using a Let’s Encrypt R12 certificate. DNS resolution points to 50.6.199.153, an IP address associated with Oracle Corporation infrastructure in the United States, and the domain is delegated to the nameservers dns1.dnspremium.pro and dns2.dnspremium.pro.

Reputation services indicate extreme distrust: Gridinsoft assigns a score of 0 out of 100, Scamadviser rates it 1 out of 100, and the domain appears on at least one security blocklist. VirusTotal scans reported that 14 of 94 antivirus engines flagged the domain as malicious, and PhishDestroy has actively blocked it. The page title returned by the server is "Access Denied," consistent with a typical shutdown response after takedown.

The registrar listed is Sav.com, LLC. While the offline status limits current exposure, the observed infrastructure—especially the low trust scores, multiple vendor detections, and blocklist presence—confirms that the domain was used for credential phishing. Defenders should continue to block the domain and its associated IP address, monitor for any reactivation, and incorporate the observed nameserver and hosting details into threat‑intel feeds to pre‑empt future abuse.