lntsagrams[.]com

Analysis of lntsagrams.com shows that the domain is currently active and associated with a generic phishing campaign. The site returns an HTTP 403 status code and presents a page title identical to the domain name, suggesting a deliberately minimal surface. The domain resolves to 213.142.143.2, an address located in Turkey and assigned to AS60707 Kapteyan A.S. The hosting infrastructure uses a Let’s Encrypt certificate (issuer E8) and supports HTTP/3, indicating a modern web stack.

Registration data reveal that GoDaddy.com, LLC created the domain on November 11 2023, and the authoritative name servers are da1.kapteyan.com.tr and da2.kapteyan.com.tr. Intelligence sources corroborate malicious use: AlienVault OTX lists the domain in 14 separate threat pulses, and PhishDestroy has added it to its blocklist; overall the domain appears on one additional security blocklist. A Gridinsoft trust score of 0 / 100 and a VirusTotal detection ratio of 14‑of‑95 security vendors further confirm the malicious reputation. MX records exist (mail.lntsagrams.com, priority 10), which may be used for credential harvesting or spam distribution.

While the exact phishing lure, target audience, and page content have not been publicly disclosed, the convergence of multiple independent detections, a low trust rating, and the presence of a dedicated mail subdomain strongly indicate an operational phishing infrastructure. Defenders should block the domain and its associated IP at network perimeters, add the name servers to DNS sinkhole lists, and monitor for any outbound connections to the host. Continuous enrichment of internal feed with the OTX pulse identifiers and periodic re‑scanning on VirusTotal are recommended to capture any evolution of the payload or hosted resources.